fix(node-sdk): honor --agent disallowedTools in the interactive TUI - #3441
fix(node-sdk): honor --agent disallowedTools in the interactive TUI#3441astraltrekkin wants to merge 1 commit into
Conversation
Interactive TUI sessions created through the v2 SDK dropped agentProfile and agentFiles, so a custom agent's disallowedTools list never applied. Co-authored-by: Noa <rainbowgore@users.noreply.github.com>
🦋 Changeset detectedLatest commit: d3f7068 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d3f7068854
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const next = | ||
| agentFiles !== undefined && agentFiles.length > 0 ? [...agentFiles] : undefined; | ||
| if (next === undefined && hostArgs.agentFiles === undefined) return; | ||
| hostArgs.agentFiles = next; |
There was a problem hiding this comment.
When two createSession calls with different agentFiles overlap, both mutate the App-shared IBootstrapService.args before awaiting an asynchronous workspace-loader reload. A reload can therefore read the other call's files, causing creation to fail with profile.unknown or, when the files define the same profile name, binding the wrong tools/disallowedTools policy. Sequential calls also replace or clear the workspace-wide explicit contribution even though agentFiles is documented as session-specific; pass the files through a session-scoped input rather than shared bootstrap state.
Useful? React with 👍 / 👎.
2 participants
Related Issue
#3417
Problem
A custom agent's
disallowedToolspolicy is applied in print mode (kimi --agent dev -p) but ignored in the interactive TUI (kimi --agent dev). With~/.kimi-code/agents/dev.mddenying Read/Write/Edit, the TUI main agent still exposes those tools (63 tools inllm.tools_snapshot) and can execute Read. Print mode correctly drops them (60 tools).Root cause: the TUI creates sessions through
SDKRpcClientV2.createSession, which discardedagentProfile/agentFilesand bound the defaultagentprofile. Print mode binds the named profile viaISessionManager.create({ mainAgentBinding }).What changed
SDKRpcClientV2.createSessionnow binds the startup--agent/--agent-fileprofile the same way print mode does:--agent, or the first--agent-filefrontmatter name).--agent-filepaths on the workspace explicit loader before bind.mainAgentBindinginto session create sotools/disallowedToolsapply to the interactive main agent.--agentname at create (profile.unknown) instead of silently using the default profile.Regression tests in
packages/node-sdk/test/sdk-rpc-client-v2.test.tscover the--agentdenylist, an--agent-filethat is not in user/project agent dirs, and unknown-name failure.Checklist
/approve).gen-changesetsskill, or this PR needs no changeset.gen-docsskill, or this PR needs no doc update.