Repository navigation
hookprobe: the investigator's built-in tools are a closed list, so a CLI upgrade no longer brings tools nobody reviewed - #43
Merged
Conversation
…I upgrade no longer brings tools nobody reviewed Under bypassPermissions allowed_tools restricts nothing, so a run could reach whatever the bundled CLI shipped. CLI 2.1.316 (v0.10.0) added Monitor, ListAgents and ToolSearch and put most tools behind ToolSearch, measured with a recording stand-in model on the published 0.9.2 and 0.10.0 images. The engine now passes the SDK a base set (tools): Bash, Read, Write, Edit, Glob, Grep, WebSearch, WebFetch, Skill, Agent and the four task-list tools that replaced TodoWrite. ToolSearch stays out, so nothing is deferred. Read back from this change's image with a one-tool MCP server: exactly the listed tools and the MCP tool are offered, the MCP tool answers, and Monitor and ToolSearch are refused as tools that do not exist, in subagents too. A test pins the list and a guard mutation removes it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The investigator's built-in tools are now a closed list. Under
bypassPermissionsthe engine'sallowed_toolsrestricts nothing, so until now a run could reach whatever the bundled CLI shipped, and the CLI moves with every relock of the SDK.Why now. Measured with a recording stand-in for the model API on the published images:
Monitor, ListAgents and ToolSearch were new in 2.1.316, and TaskOutput was gone. None of it had been reviewed. Monitor runs shell commands. Loaded through ToolSearch, its write into
results/was still refused, because the CLI runs the Bash hook for it. That held by the CLI's choice; the bash guard's matcher only names Bash.The change. The engine passes the SDK a base set,
tools: Bash, Read, Write, Edit, Glob, Grep, WebSearch, WebFetch, Skill, Agent, and the four task-list tools that replaced TodoWrite. The CLI offers nothing else, in a run or in its subagents. ToolSearch stays out, so nothing is deferred. MCP tools are untouched;HOOKPROBE_MCP_TOOLSand the MCP guard already decide those.Read back from this branch's image, with a one-tool MCP server mounted read-only:
Pinned. A test pins the list and names the tools kept out, and a guard mutation that removes the base set is caught. The containment row for closed sets, the README and a decision note say what it stops and what it does not. The CLI ignores a name it does not know, so a tool a later CLI renames would drop out without a word. An SDK bump has to be checked against what the new CLI offers.
Found, not changed: the console's live plan still reads TodoWrite calls, which no current CLI offers, so the task-list tools show as ordinary steps.
Gate: STACK GATE GREEN locally. The inline-JS parse step ran on a Node container, because the Homebrew Node on this machine cannot load a library a dependency upgrade removed. CI read back before merging.