chore: release packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to master, this PR will be updated.

Releases

@agentrail/app@0.6.0

Minor Changes

• #141 0075fc6 Thanks @yai-dev! - Fix and extend the tool permission policy system:

  • Add "strict" PermissionMode: deny-by-default mode where only operations listed in allow are permitted. Use for minimal-privilege configurations.
  • Add contentMode: "path" | "command" parameter to matchPattern and evaluatePolicy. Bash tools now pass "command" so that * wildcards match across / in command arguments (e.g. git:add src/main.ts matches Bash(git:*)).
  • Fix missing ? in regex escape list — a literal ? in a pattern no longer acts as an optional quantifier.
  • Fix cross-platform ancestor resolution in path-safety.ts using path.dirname loop instead of POSIX-specific split/join.
  • Fix normalizeBashCommand to handle tab and other whitespace between verb and arguments.
  • Export ContentMatchMode type from @agentrail/capabilities.
  • AgentrailPermissionsConfig.mode and agentrail.yaml now accept "strict" as a valid permissions mode.

• #140 81f5cca Thanks @yai-dev! - Add chainId, depth, and turnIndex tracing fields to every RuntimeEvent.

  • @agentrail/core: RuntimeTracingFields interface exported from the package root. Every RuntimeEvent variant is now intersected with RuntimeTracingFields (all three fields are required). AgentRunOptions gains optional chainId and depth fields that flow into the agent loop. InternalContext is extended with the same optional fields.
  • @agentrail/capabilities: CapabilityBuildContext gains an optional tracing field { chainId: string; depth: number }. SpawnAgentInput and CreateManagedAgentInput gain optional chainId and depth fields. The spawn_agent tool increments depth and propagates chainId to the child agent. WorkerInitMessage and WorkerState carry the same fields so the worker process can pass them to agent.invoke.
  • @agentrail/app: AgentrailProfileContext gains an optional chainId field. The route-level traceId / requestTraceId is propagated as chainId into AgentrailProfileContext, CapabilityBuildContext.tracing, and AgentRunOptions.chainId so that RuntimeEvent.chainId === telemetry traceId for the full request chain.

• #141 405d8de Thanks @yai-dev! - Add tool permission policy system

  Introduces a structured, rule-based permission layer that sits between the LLM
  and tool execution, enabling fine-grained control over which operations agents
  are allowed to perform.

  @agentrail/core

  • New PermissionDecision type ("allow" | "deny" | "ask" or object form with optional reason).
  • New optional checkPermissions(params) hook on RuntimeTool — called after
    onBeforeToolCall interceptors but before validate and execute.
  • New permission_request RuntimeEvent — emitted when checkPermissions returns "ask".
  • ToolBuilder gains a .checkPermissions() fluent method.
  • permission_request is added to TRACE_PERSISTED_EVENT_TYPES.

  @agentrail/capabilities

  • New packages/capabilities/src/permissions/ module:
    • ToolPermissionPolicy / PermissionRule / PermissionMode types.
    • parseRule / parseRules DSL parser (e.g. "Bash(git:*)", "Write(/workspace/**)")
    • evaluatePolicy rule engine with priority order: deny → ask → allow → default.
    • isPathSafe / workspaceAnchor path-safety utilities.
    • isDangerousCommand / isReadOnlyCommand shell-safety utilities.
  • CapabilityBuildContext gains optional permissionPolicy?: ToolPermissionPolicy.
  • Non-sandboxed bashTool, readTool, writeTool, editTool are now created via
    factory functions (createBashTool, createReadTool, createWriteTool, createEditTool)
    that accept optional rootDir and policy options; the singleton exports are
    kept for backward compatibility.
  • Sandboxed createSandboxedBash accepts an optional policy parameter.
  • All new symbols are exported from the package root.

  @agentrail/app

  • AgentrailProfileContext gains optional permissionPolicy?: ToolPermissionPolicy.
  • defineProfile propagates permissionPolicy from profile context into
    CapabilityBuildContext.
  • createAgentApp, createStreamRoute, and createChatRoute all accept an
    optional permissionPolicy option that is forwarded to every request.
  • AgentrailConfig (YAML config) gains an optional permissions block with
    mode, allow, deny, and ask keys.
  • DefaultCapabilityToolOptions gains optional permissionPolicy forwarded to
    sandboxed tools.

Patch Changes

• Updated dependencies [8e9b041, 0075fc6, 81f5cca, 405d8de]:
  • @agentrail/capabilities@0.3.0
  • @agentrail/core@0.6.0

@agentrail/capabilities@0.3.0

Minor Changes

• #138 8e9b041 Thanks @yai-dev! - Add toolCalls field to sub-agent job results

  ManagedAgentDeliveryResult and OrchestrationAgentJob now carry a toolCalls array with every tool call the sub-agent made during a job, including the tool name, input arguments, and the full output (content and structured details). The wait_agent tool result now includes the resolution object so the parent LLM can see outputText and toolCalls.

• #141 0075fc6 Thanks @yai-dev! - Fix and extend the tool permission policy system:

  • Add "strict" PermissionMode: deny-by-default mode where only operations listed in allow are permitted. Use for minimal-privilege configurations.
  • Add contentMode: "path" | "command" parameter to matchPattern and evaluatePolicy. Bash tools now pass "command" so that * wildcards match across / in command arguments (e.g. git:add src/main.ts matches Bash(git:*)).
  • Fix missing ? in regex escape list — a literal ? in a pattern no longer acts as an optional quantifier.
  • Fix cross-platform ancestor resolution in path-safety.ts using path.dirname loop instead of POSIX-specific split/join.
  • Fix normalizeBashCommand to handle tab and other whitespace between verb and arguments.
  • Export ContentMatchMode type from @agentrail/capabilities.
  • AgentrailPermissionsConfig.mode and agentrail.yaml now accept "strict" as a valid permissions mode.

• #140 81f5cca Thanks @yai-dev! - Add chainId, depth, and turnIndex tracing fields to every RuntimeEvent.

  • @agentrail/core: RuntimeTracingFields interface exported from the package root. Every RuntimeEvent variant is now intersected with RuntimeTracingFields (all three fields are required). AgentRunOptions gains optional chainId and depth fields that flow into the agent loop. InternalContext is extended with the same optional fields.
  • @agentrail/capabilities: CapabilityBuildContext gains an optional tracing field { chainId: string; depth: number }. SpawnAgentInput and CreateManagedAgentInput gain optional chainId and depth fields. The spawn_agent tool increments depth and propagates chainId to the child agent. WorkerInitMessage and WorkerState carry the same fields so the worker process can pass them to agent.invoke.
  • @agentrail/app: AgentrailProfileContext gains an optional chainId field. The route-level traceId / requestTraceId is propagated as chainId into AgentrailProfileContext, CapabilityBuildContext.tracing, and AgentRunOptions.chainId so that RuntimeEvent.chainId === telemetry traceId for the full request chain.

• #141 405d8de Thanks @yai-dev! - Add tool permission policy system

  Introduces a structured, rule-based permission layer that sits between the LLM
  and tool execution, enabling fine-grained control over which operations agents
  are allowed to perform.

  @agentrail/core

  • New PermissionDecision type ("allow" | "deny" | "ask" or object form with optional reason).
  • New optional checkPermissions(params) hook on RuntimeTool — called after
    onBeforeToolCall interceptors but before validate and execute.
  • New permission_request RuntimeEvent — emitted when checkPermissions returns "ask".
  • ToolBuilder gains a .checkPermissions() fluent method.
  • permission_request is added to TRACE_PERSISTED_EVENT_TYPES.

  @agentrail/capabilities

  • New packages/capabilities/src/permissions/ module:
    • ToolPermissionPolicy / PermissionRule / PermissionMode types.
    • parseRule / parseRules DSL parser (e.g. "Bash(git:*)", "Write(/workspace/**)")
    • evaluatePolicy rule engine with priority order: deny → ask → allow → default.
    • isPathSafe / workspaceAnchor path-safety utilities.
    • isDangerousCommand / isReadOnlyCommand shell-safety utilities.
  • CapabilityBuildContext gains optional permissionPolicy?: ToolPermissionPolicy.
  • Non-sandboxed bashTool, readTool, writeTool, editTool are now created via
    factory functions (createBashTool, createReadTool, createWriteTool, createEditTool)
    that accept optional rootDir and policy options; the singleton exports are
    kept for backward compatibility.
  • Sandboxed createSandboxedBash accepts an optional policy parameter.
  • All new symbols are exported from the package root.

  @agentrail/app

  • AgentrailProfileContext gains optional permissionPolicy?: ToolPermissionPolicy.
  • defineProfile propagates permissionPolicy from profile context into
    CapabilityBuildContext.
  • createAgentApp, createStreamRoute, and createChatRoute all accept an
    optional permissionPolicy option that is forwarded to every request.
  • AgentrailConfig (YAML config) gains an optional permissions block with
    mode, allow, deny, and ask keys.
  • DefaultCapabilityToolOptions gains optional permissionPolicy forwarded to
    sandboxed tools.

Patch Changes

• Updated dependencies [81f5cca, 405d8de]:
  • @agentrail/core@0.6.0

@agentrail/core@0.6.0

Minor Changes

• #140 81f5cca Thanks @yai-dev! - Add chainId, depth, and turnIndex tracing fields to every RuntimeEvent.

  • @agentrail/core: RuntimeTracingFields interface exported from the package root. Every RuntimeEvent variant is now intersected with RuntimeTracingFields (all three fields are required). AgentRunOptions gains optional chainId and depth fields that flow into the agent loop. InternalContext is extended with the same optional fields.
  • @agentrail/capabilities: CapabilityBuildContext gains an optional tracing field { chainId: string; depth: number }. SpawnAgentInput and CreateManagedAgentInput gain optional chainId and depth fields. The spawn_agent tool increments depth and propagates chainId to the child agent. WorkerInitMessage and WorkerState carry the same fields so the worker process can pass them to agent.invoke.
  • @agentrail/app: AgentrailProfileContext gains an optional chainId field. The route-level traceId / requestTraceId is propagated as chainId into AgentrailProfileContext, CapabilityBuildContext.tracing, and AgentRunOptions.chainId so that RuntimeEvent.chainId === telemetry traceId for the full request chain.

• #141 405d8de Thanks @yai-dev! - Add tool permission policy system

  Introduces a structured, rule-based permission layer that sits between the LLM
  and tool execution, enabling fine-grained control over which operations agents
  are allowed to perform.

  @agentrail/core

  • New PermissionDecision type ("allow" | "deny" | "ask" or object form with optional reason).
  • New optional checkPermissions(params) hook on RuntimeTool — called after
    onBeforeToolCall interceptors but before validate and execute.
  • New permission_request RuntimeEvent — emitted when checkPermissions returns "ask".
  • ToolBuilder gains a .checkPermissions() fluent method.
  • permission_request is added to TRACE_PERSISTED_EVENT_TYPES.

  @agentrail/capabilities

  • New packages/capabilities/src/permissions/ module:
    • ToolPermissionPolicy / PermissionRule / PermissionMode types.
    • parseRule / parseRules DSL parser (e.g. "Bash(git:*)", "Write(/workspace/**)")
    • evaluatePolicy rule engine with priority order: deny → ask → allow → default.
    • isPathSafe / workspaceAnchor path-safety utilities.
    • isDangerousCommand / isReadOnlyCommand shell-safety utilities.
  • CapabilityBuildContext gains optional permissionPolicy?: ToolPermissionPolicy.
  • Non-sandboxed bashTool, readTool, writeTool, editTool are now created via
    factory functions (createBashTool, createReadTool, createWriteTool, createEditTool)
    that accept optional rootDir and policy options; the singleton exports are
    kept for backward compatibility.
  • Sandboxed createSandboxedBash accepts an optional policy parameter.
  • All new symbols are exported from the package root.

  @agentrail/app

  • AgentrailProfileContext gains optional permissionPolicy?: ToolPermissionPolicy.
  • defineProfile propagates permissionPolicy from profile context into
    CapabilityBuildContext.
  • createAgentApp, createStreamRoute, and createChatRoute all accept an
    optional permissionPolicy option that is forwarded to every request.
  • AgentrailConfig (YAML config) gains an optional permissions block with
    mode, allow, deny, and ask keys.
  • DefaultCapabilityToolOptions gains optional permissionPolicy forwarded to
    sandboxed tools.

@agentrail/cli@0.2.5

Patch Changes

• Updated dependencies [0075fc6, 81f5cca, 405d8de]:
  • @agentrail/app@0.6.0

@agentrail/create-agentrail-app@0.2.5

Patch Changes

• Updated dependencies []:
  • @agentrail/cli@0.2.5

@agentrail/deep-research@0.0.13

Patch Changes

• Updated dependencies [8e9b041, 0075fc6, 81f5cca, 405d8de]:
  • @agentrail/capabilities@0.3.0
  • @agentrail/core@0.6.0

@agentrail/testing@0.0.9

Patch Changes

• Updated dependencies [81f5cca, 405d8de]:
  • @agentrail/core@0.6.0