The default surface was 34 tools, 61 KB, ~15,300 tokens of schema in every
prompt of every agent. The mode system already names what a session should
carry, but only the tools register_all_tools enumerates obeyed it: zsh,
curl, playwright and the helpers (ps, npx, uvx, jq, wget, cdp, open) stayed
on in every mode. A mode now decides every discovered tool, the `hanzo`
mode lists what a coding agent calls every few steps (18 tools, 32 KB,
~8,000 tokens), and the rest is a name away: HANZO_MCP_ENABLED_TOOLS=a,b
or =all, `tool enable`, or `mode`.
hanzo-tools-shell 0.6.6: run_shell kept every byte a foreground command
wrote until the command ended. `yes` for thirty seconds is gigabytes. It
keeps the first 16 MiB per stream and drains the rest.
The tests' session-wide patch of asyncio.create_subprocess_exec handed
every shell command a stream that never reached EOF; the first test to run
one read it in a loop until the machine was out of memory (22 GB, killed).
The patch is now opt-in and its process has exited.
bench/latency.py measures the cold start, the tools/list bill and the common
calls through a real MCP client over stdio. Interleaved rounds, wall and CPU
seconds, p50 over 6 cold starts:
cold wall cold CPU tools bytes ~tokens
installed 0.15.18 9.34 s 10.46 s 30 52,601 13,150
main 0.15.20 1.52 s 1.13 s 34 61,287 15,321
this 0.96 s 1.06 s 18 32,222 8,055
The installed environment's 9 s is its hanzoai 8.5.156, whose package init
imports the whole generated cloud client; hanzo-mcp >= 0.15.20 requires
hanzoai >= 8.5.624, which loads it lazily. Per-call latency is spawn-bound
(zsh 17.6 ms, git status 33 ms, fs.read 2.5 ms at p50) and moves with the
machine's load; no call path changed.
The README offered the two key shapes as a permission split — pk- to read,
sk- to write. cloud's own identity boundary says otherwise: middleware_identity
returns nil for any pk- before it consults the key store, because a key meant
for a browser bundle must not read. A pk- resolves to an org so a beacon can be
attributed to a tenant, and that is all it does.
Following the old sentence, a reader exports a pk- and every one of the five
flows answers 403 — /v1/tools spells out why, "a validated principal is
required" — and that refusal reads like a revoked key rather than the wrong
shape of key. examples/client.py now refuses a pk- before the request goes out,
the same argument that already rejects an unsendable access_token.
Also: three status codes in example docstrings had drifted from what the API
answers now (/v1/kv/keys/* 404s on every verb, /v1/automations/mcp 404s), and
two dead files went with them — examples/.keep, whose directory has held real
flows for a while, and scripts/mock, which reads a .stats.yml this repo does
not have and which scripts/test already says is unnecessary.
Field(alias="json") doesn't translate to Python kwargs — FastMCP
passes the schema name directly. Rename json_body to json in the
registered function signature.
- exec_tool: add Windows shell detection (pwsh/cmd), use taskkill for process kill
- shell_detect: skip Unix paths on Windows, add pwsh/cmd fallback chain
- dev.py: replace all `which` subprocess calls with shutil.which()
- test_hanzo_dev: use shutil.which() instead of subprocess which
Run ruff check --fix and ruff format across the repo to fix ~495
auto-fixable lint errors (mostly I001 import sorting) and reformat
225 files to match the py312 target.
Co-authored-by: Hanzo Dev <[email protected]>
- Remove 'cmd' from default TOOLS list - only detected shell exposed
- Add KshTool, TcshTool, CshTool for enterprise Unix shells
- Fallback to ShellTool (smart auto-detect) if shell detection fails
- Support ksh93, pdksh, mksh as aliases for ksh
- Bump hanzo-tools-shell to 0.6.1, hanzo-mcp to 0.10.37
- Add shell_detect.py module with comprehensive shell detection:
- Detects login shell from passwd/Directory Services
- Detects invoking shell by walking parent processes
- Prefers Homebrew shell paths on macOS
- Supports override via HANZO_MCP_SHELL and HANZO_MCP_FORCE_SHELL
- Update hanzo-tools-shell to only include detected shell in TOOLS list
- HANZO_MCP_ALL_SHELLS=1 to expose all shells
- get_shell_tools() now supports shell_override parameter
- Add CLI options to hanzo-mcp:
- --shell: Specify shell by name or path
- --all-shells: Expose all shell tools
- Updated --force-shell to include fish and dash
- Bump hanzo-tools-shell to 0.6.0 (published to PyPI)
- Bump hanzo-mcp to 0.10.36
Detection order: HANZO_MCP_SHELL > HANZO_MCP_FORCE_SHELL > CLI --shell >
invoking shell > login shell > $SHELL
- Change default timeout from 45s to 30s for faster response
- Fix potential hanging in run_shell by using stream reading instead of communicate()
- Add start_new_session=True to prevent zombie processes
- Proper cleanup on error with process.kill()
- All stream reading uses chunked async reads (8KB chunks)
- Partial output preserved when backgrounding
53 tests pass in 1.1s.
- Remove ShellTool from TOOLS list (too ambiguous)
- Keep zsh, bash, fish, dash as specific shell tools
- Update get_shell_tools to include bash
- Fix test imports (ShellTool now in shell_tools.py)
- Update tests to expect cmd as primary tool
- Verify asyncio.gather + uvloop works correctly
hanzo-tools-shell: 0.5.1 → 0.5.2
- Add shellflow.py: minimal DSL for DAG execution
- Syntax: A ; B (sequential), { A & B } (parallel)
- Compiles to JSON AST, S-expressions, or command list
- Supports quoted strings, &&, ||, nested braces
- Performance optimizations:
- Precompiled regex with local variable caching
- Fast-path for simple/sequential commands (8x faster)
- LRU cache for repeated patterns
- Full type annotations for mypyc compilation
- Restore dag as separate semantic tool:
- dag: for parallel/serial/graph execution
- zsh: for shell commands with shellflow DSL
- Both support nested arrays for auto-parallel
- Add comprehensive test suite (53 tests):
- Tokenizer, parser, normalization tests
- S-expression and command conversion tests
- Performance benchmarks
- Integration tests with real shell execution
Performance: ~7M ops/sec for simple commands,
~220k ops/sec for sequential, ~100k ops/sec for mixed DAGs
Shellflow syntax:
A ; B ; C → sequential
{ A & B & C } → parallel
A ; { B & C } ; D → mixed
Usage:
zsh("mkdir dist ; { cp a dist/ & cp b dist/ } ; zip out.zip dist/")
Compiles to JSON AST then executes via DAG.
Bump to v0.4.0
- ZshTool now includes full DAG functionality (serial, parallel, graph)
- Single "zsh" command for all shell operations
- Usage: zsh("ls") or zsh(["cmd1", "cmd2"]) or zsh([...], parallel=True)
- DagTool kept in codebase for backwards compatibility
- Removed DagTool from default TOOLS list
- Bump hanzo-tools-shell to v0.3.1
Add three new shell tools that bypass shell escaping issues by using
subprocess with list arguments instead of shell interpretation:
- curl: HTTP client with proper JSON body handling
- jq: JSON processor with direct filter passing
- wget: File/site downloads with mirror mode support
These tools solve the common problem of shell escaping nightmares
when working with complex JSON or special characters.
Updates:
- Added CurlTool, JqTool, WgetTool to hanzo-tools-shell
- Updated __all__ exports and TOOLS list
- Added tools to entrypoint_loader PACKAGE_TOOL_PREFIXES
Add runtime check to provide better error message if ProcessManager()
returns None. This should never happen with proper singleton pattern,
but helps diagnose issues in edge cases.
zeekay
