feat: agent auto-install, AI approval refactor, and misc fixes - #2
Merged
Conversation
Previously the system prompt was concatenated into the user message. Now it's sent as a separate `system` field in the prompt_async request body, matching the OpenCode API's PromptInput schema. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Remove overly broad system path patterns (/etc/, /var/, /usr/, /bin/, /sbin/) from hard block list. Instead, detect rm commands that reference paths escaping the project root via path_escapes_project(). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Before pushing the first user message, pre-seed the in-memory message cache from the provider's archive so that list_messages doesn't shadow historical conversation. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Add AgentInstallResult, AgentInstallInput, and AgentSummary models for the agent auto-install API. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Add /agents and /agents/install endpoints. Agents can be installed via npm, brew, or platform-specific install scripts. Falls back to manual install hints when auto-install is unavailable. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Auto-approve Claude Code permission requests using the same policy as Codex, instead of always requiring user approval. - Guard against empty body files in next_claude_permission_request and next_claude_status_event to prevent JSON parse errors. - Remove redundant AI approval check from Claude permission hook. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Use `---` to separate multiple content blocks within a single assistant turn, both for real-time streaming and historical messages. Filter out `tool_result` user entries in Claude Code archives so consecutive assistant text blocks merge into one message. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Previously the Claude Code hook skipped the AI risk assessment layer entirely — commands not matched by the deterministic policy went straight to human approval. Now the hook calls ai_approval::review_request() before escalating, consistent with the Codex/OpenCode paths. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Include the failure reason directly in the session_status event payload so clients don't need to correlate a separate AgentError event. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GET /agentsandPOST /agents/installendpointsrmpath escape detection with proper path normalization instead of hardcoded system path prefixes---separator across all providers (Claude, Codex, OpenCode)error_messagefield toSessionStatusEventfor failed sessionsTest plan
GET /agentsandPOST /agents/installrmpath escape detection with relative and absolute paths🤖 Generated with Claude Code