fix(claude-cli): return updatedInput in can_use_tool allow response (#98665)

yetval · web-flow · commit a5a8d992aecb · 2026-07-01T08:11:38.000-07:00
Claude Code >= 2.1.156 tightened its PermissionResult schema so an approved can_use_tool control_response allow branch must carry an updatedInput record. The Claude live-session bridge answered with the deprecated { behavior: "allow" } shape and no updatedInput, so the CLI rejected every approval-gated native tool call (Bash, WebFetch, and AskUserQuestion among them) with a ZodError before the tool ran. Echo the tool input back unchanged as updatedInput on the allow branch, matching the shape the Claude Code 2.1 binary expects. The deny branch and all other behavior are unchanged. Fixes #95171.
diff --git a/src/agents/cli-runner.spawn.test.ts b/src/agents/cli-runner.spawn.test.ts
@@ -1960,14 +1960,15 @@ ${JSON.stringify({
       response: {
         subtype: string;
         request_id: string;
-        response: { behavior: string; toolUseID?: string };
+        response: { behavior: string; toolUseID?: string; updatedInput?: unknown };
       };
     };
     expect(parsed.type).toBe("control_response");
     expect(parsed.response.subtype).toBe("success");
     expect(parsed.response.request_id).toBe("req-allow");
     expect(parsed.response.response.behavior).toBe("allow");
     expect(parsed.response.response.toolUseID).toBe("tool-allow-1");
+    expect(parsed.response.response.updatedInput).toEqual({ command: "ls" });
   });
 
   it("reports Claude live stream progress and keeps native tools fresh while they are running", async () => {
@@ -2329,11 +2330,12 @@ ${JSON.stringify({
       response: {
         subtype: string;
         request_id: string;
-        response: { behavior: string; toolUseID?: string };
+        response: { behavior: string; toolUseID?: string; updatedInput?: unknown };
       };
     };
     expect(parsed.response.response.behavior).toBe("allow");
     expect(parsed.response.response.toolUseID).toBe("tool-default-allow-1");
+    expect(parsed.response.response.updatedInput).toEqual({ command: "echo hi" });
   });
 
   it("answers Claude live control_request can_use_tool with deny when approval defaults are restrictive", async () => {
diff --git a/src/agents/cli-runner/claude-live-session.ts b/src/agents/cli-runner/claude-live-session.ts
@@ -866,6 +866,7 @@ function handleClaudeLiveControlRequest(
     return;
   }
   const toolUseId = typeof request.tool_use_id === "string" ? request.tool_use_id : undefined;
+  const toolInput = isRecord(request.input) ? request.input : {};
   const allowed = turn.execPermission.security === "full" && turn.execPermission.ask === "off";
   writeClaudeLiveControlResponse(session, {
     type: "control_response",
@@ -875,6 +876,7 @@ function handleClaudeLiveControlRequest(
       response: allowed
         ? {
             behavior: "allow",
+            updatedInput: toolInput,
             ...(toolUseId ? { toolUseID: toolUseId } : {}),
           }
         : {
