@caupulican/pi-adaptative 0.81.39 → 0.81.40

package/dist/core/runtime-builder.js

@@ -36,7 +36,7 @@ import { createHash } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { isAbsolute, join } from "node:path";
 import { DEFAULT_ACTIVE_TOOL_NAMES, mapToolNamesForPlatform } from "./default-tool-surface.js";
-import { acknowledgeWorkerResultReview } from "./delegation/session-worker-result.js";
+import { acknowledgeWorkerClaimReview } from "./delegation/session-worker-claim.js";
 import { createCoreDiagnosticsToolDefinitions } from "./extensions/builtin.js";
 import { ExtensionRunner, wrapRegisteredTools, } from "./extensions/index.js";
 import { disposeExtensionEventSubscriptions } from "./extensions/loader.js";
@@ -49,18 +49,21 @@ import { ScoutController } from "./scout-controller.js";
 import { getSessionRole, isWorkerSession, WORKER_FORBIDDEN_TOOLS } from "./session-role.js";
 import { matchesResourceProfilePattern, } from "./settings-manager.js";
 import { createSyntheticSourceInfo } from "./source-info.js";
+import { projectOpenTaskSteps } from "./tasks/task-projection.js";
 import { buildReflexUserPrompt, parseReflexPlan, REFLEX_INTERPRETER_SYSTEM_PROMPT, } from "./toolkit/reflex-interpreter.js";
 import { executeToolkitScript } from "./toolkit/script-runner.js";
+import { createAskQuestionToolDefinition } from "./tools/ask-question.js";
 import { createContextScoutToolDefinition } from "./tools/context-scout.js";
 import { createDelegateToolDefinition } from "./tools/delegate.js";
 import { createDelegateStatusToolDefinition } from "./tools/delegate-status.js";
 import { createFindTool } from "./tools/find.js";
 import { createGoalToolDefinition } from "./tools/goal.js";
 import { createGrepTool } from "./tools/grep.js";
-import { createAllToolDefinitions } from "./tools/index.js";
+import { allToolNames, createToolDefinition } from "./tools/index.js";
 import { createModelFitnessToolDefinition } from "./tools/model-fitness.js";
 import { resolveToCwd } from "./tools/path-utils.js";
 import { createReadTool } from "./tools/read.js";
+import { createRunProcessToolDefinition } from "./tools/run-process.js";
 import { createRunToolkitScriptToolDefinition } from "./tools/run-toolkit-script.js";
 import { createTaskStepsToolDefinition } from "./tools/task-steps.js";
 import { dispatchTmuxWorker } from "./tools/tmux-dispatch.js";
@@ -93,16 +96,15 @@ export function hasAnsweredToolCallOnBranch(sessionManager, toolCallId) {
         .some((entry) => entry.type === "message" && entry.message.role === "toolResult" && entry.message.toolCallId === toolCallId);
 }
 /**
- * Project a task-steps snapshot down to the OPEN (non-terminal) steps the goal tool's
- * cross-visibility nudge needs. Mirrors `goal-runtime-snapshot.ts`'s `openTaskSteps` filter
- * (status not "completed"/"cancelled", `activeForm || content`) so the two read the same
- * "open" definition, narrowed to `OpenTaskStepRef`'s id+content shape. Exported (pure, no
- * `this`) so the goal tool's `getOpenTaskSteps` wiring below is directly testable.
+ * Goal-tool adapter over the canonical open-task projection. Exported (pure, no `this`) so the
+ * production `getOpenTaskSteps` wiring below remains directly testable without another filter.
  */
 export function deriveOpenTaskStepRefs(taskStepsState) {
-    return (taskStepsState?.steps ?? [])
-        .filter((step) => step.status !== "completed" && step.status !== "cancelled")
-        .map((step) => ({ id: step.id, content: step.activeForm || step.content }));
+    return projectOpenTaskSteps(taskStepsState).map((step) => ({
+        id: step.id,
+        content: step.content,
+        ...(step.requirementIds?.length ? { requirementIds: step.requirementIds } : {}),
+    }));
 }
 /**
  * Owns the tool-registry build and the self-modification-safe extension reload extracted from
@@ -121,6 +123,50 @@ export class RuntimeBuilder {
     constructor(deps) {
         this.deps = deps;
     }
+    /**
+     * Resolve the construction and activation policy once for a runtime generation. This is the
+     * UAC choke point: callers must consult it before invoking a tool factory, not merely before
+     * placing an already-created definition in the live registry.
+     */
+    _createToolAccessPolicy() {
+        const role = getSessionRole();
+        const configuredAllowedToolNames = this.deps.getAllowedToolNames();
+        const allowedToolNames = configuredAllowedToolNames
+            ? new Set(mapToolNamesForPlatform([...configuredAllowedToolNames]))
+            : undefined;
+        const configuredExcludedToolNames = this.deps.getExcludedToolNames();
+        const excludedToolNames = configuredExcludedToolNames
+            ? new Set(mapToolNamesForPlatform([...configuredExcludedToolNames]))
+            : undefined;
+        const configuredToolProfileFilter = this.deps.getToolProfileFilter();
+        const toolProfileFilter = configuredToolProfileFilter
+            ? {
+                allow: mapToolNamesForPlatform(configuredToolProfileFilter.allow),
+                block: mapToolNamesForPlatform(configuredToolProfileFilter.block),
+            }
+            : undefined;
+        return {
+            allowedToolNames,
+            toolProfileFilter,
+            allows: (name) => {
+                // Strict worker UAC ceiling wins over every explicit grant.
+                if (role === "worker" && WORKER_FORBIDDEN_TOOLS.has(name))
+                    return false;
+                if (allowedToolNames && !allowedToolNames.has(name))
+                    return false;
+                if (excludedToolNames?.has(name))
+                    return false;
+                if (!toolProfileFilter)
+                    return true;
+                if (toolProfileFilter.allow.length > 0 && !matchesResourceProfilePattern(name, toolProfileFilter.allow)) {
+                    return false;
+                }
+                if (matchesResourceProfilePattern(name, toolProfileFilter.block))
+                    return false;
+                return true;
+            },
+        };
+    }
     async _runContextScout(query, maxTurns, artifactStore) {
         const cwd = this.deps.getCwd();
         const controller = new ScoutController({
@@ -172,46 +218,14 @@ export class RuntimeBuilder {
         return this._toolDefinitions.get(name)?.definition;
     }
     refreshToolRegistry(options) {
-        const role = getSessionRole();
         const previousRegistryNames = new Set(this._toolRegistry.keys());
         // Re-derive from the pre-filter REQUEST, never from agent.state.tools: the active set is
         // capability/profile-filtered, so feeding it back through setActiveToolsByName would
         // permanently shrink what a later switch to a larger model (or permissive profile) restores.
         const previousActiveToolNames = mapToolNamesForPlatform(this.deps.getRequestedActiveToolNames() ?? this.deps.getActiveToolNames());
-        const configuredAllowedToolNames = this.deps.getAllowedToolNames();
-        const allowedToolNames = configuredAllowedToolNames
-            ? new Set(mapToolNamesForPlatform([...configuredAllowedToolNames]))
-            : undefined;
-        const configuredExcludedToolNames = this.deps.getExcludedToolNames();
-        const excludedToolNames = configuredExcludedToolNames
-            ? new Set(mapToolNamesForPlatform([...configuredExcludedToolNames]))
-            : undefined;
-        const configuredToolProfileFilter = this.deps.getToolProfileFilter();
-        const toolProfileFilter = configuredToolProfileFilter
-            ? {
-                allow: mapToolNamesForPlatform(configuredToolProfileFilter.allow),
-                block: mapToolNamesForPlatform(configuredToolProfileFilter.block),
-            }
-            : undefined;
-        const isAllowedTool = (name) => {
-            // Strict worker UAC ceiling: wins over allow-list/exclude/profile -- a worker session
-            // (lane-bound or dispatched) can never activate this tool no matter how permissively the
-            // active profile or an explicit request names it. See session-role.ts.
-            if (role === "worker" && WORKER_FORBIDDEN_TOOLS.has(name))
-                return false;
-            if (allowedToolNames && !allowedToolNames.has(name))
-                return false;
-            if (excludedToolNames?.has(name))
-                return false;
-            if (!toolProfileFilter)
-                return true;
-            if (toolProfileFilter.allow.length > 0 && !matchesResourceProfilePattern(name, toolProfileFilter.allow)) {
-                return false;
-            }
-            if (matchesResourceProfilePattern(name, toolProfileFilter.block))
-                return false;
-            return true;
-        };
+        const toolAccess = this._createToolAccessPolicy();
+        const { allowedToolNames, toolProfileFilter } = toolAccess;
+        const isAllowedTool = toolAccess.allows;
         const registeredTools = this.deps.getExtensionRunner().getAllRegisteredTools();
         const allCustomTools = [
             ...registeredTools,
@@ -425,169 +439,211 @@ export class RuntimeBuilder {
         const shellCommandPrefix = settingsManager.getShellCommandPrefix();
         const shellPath = settingsManager.getShellPath();
         const baseToolsOverride = this.deps.getBaseToolsOverride();
+        const toolAccess = this._createToolAccessPolicy();
         // Artifact-producing tools must not emit a "Full output: artifact tool-output:<id>" handle
         // that nothing can resolve. If artifact_retrieve is explicitly excluded/blocked/outside
         // an active allowlist, don't hand grep/find/run_toolkit_script an artifact store at all:
         // they fall back to their bounded preview/truncation behavior, with no payload/meta files
         // ever written and no retrieval promise made.
-        const toolArtifactStore = this.deps.isToolOrCommandAllowedByProfile("artifact_retrieve")
-            ? this.deps.getToolArtifactStore()
-            : undefined;
-        const baseToolDefinitions = baseToolsOverride
-            ? Object.fromEntries(Object.entries(baseToolsOverride).map(([name, tool]) => [name, createToolDefinitionFromAgentTool(tool)]))
-            : createAllToolDefinitions(this.deps.getCwd(), {
-                read: { autoResizeImages },
-                bash: { commandPrefix: shellCommandPrefix, shellPath, sessionKey: this.deps.getShellSessionKey() },
-                grep: { artifactStore: toolArtifactStore },
-                find: { artifactStore: toolArtifactStore },
-                artifact_retrieve: { artifactStore: toolArtifactStore },
-            });
-        this._baseToolDefinitions = new Map(Object.entries(baseToolDefinitions).map(([name, tool]) => [name, tool]));
+        const toolArtifactStore = !baseToolsOverride && toolAccess.allows("artifact_retrieve") ? this.deps.getToolArtifactStore() : undefined;
+        const toolOptions = {
+            read: { autoResizeImages },
+            bash: {
+                commandPrefix: shellCommandPrefix,
+                shellPath,
+                sessionKey: this.deps.getShellSessionKey(),
+                platform: process.platform,
+            },
+            grep: { artifactStore: toolArtifactStore },
+            find: { artifactStore: toolArtifactStore },
+            artifact_retrieve: { artifactStore: toolArtifactStore },
+        };
+        this._baseToolDefinitions = baseToolsOverride
+            ? new Map(Object.entries(baseToolsOverride)
+                .filter(([name]) => toolAccess.allows(name))
+                .map(([name, tool]) => [name, createToolDefinitionFromAgentTool(tool)]))
+            : new Map([...allToolNames]
+                .filter((name) => toolAccess.allows(name))
+                .map((name) => [name, createToolDefinition(name, this.deps.getCwd(), toolOptions)]));
         if (!baseToolsOverride) {
-            for (const definition of createCoreDiagnosticsToolDefinitions(() => this.deps.getActiveToolNames(), () => this.getAllTools(), (messages) => this.deps.getContextGcReport(messages), () => this.deps.getMemoryAuditDiagnostics())) {
-                this._baseToolDefinitions.set(definition.name, definition);
+            if (toolAccess.allows("run_process")) {
+                const orchestrationProfile = this.deps.getOrchestrationProfile?.();
+                if (orchestrationProfile?.executionPolicy) {
+                    this._baseToolDefinitions.set("run_process", createRunProcessToolDefinition(this.deps.getCwd(), {
+                        policy: orchestrationProfile.executionPolicy,
+                        maxWallClockMs: orchestrationProfile.budget.maxWallClockMs ?? 0,
+                    }));
+                }
+            }
+            if (toolAccess.allows("context_audit")) {
+                for (const definition of createCoreDiagnosticsToolDefinitions(() => this.deps.getActiveToolNames(), () => this.getAllTools(), (messages) => this.deps.getContextGcReport(messages), () => this.deps.getMemoryAuditDiagnostics())) {
+                    this._baseToolDefinitions.set(definition.name, definition);
+                }
             }
             // Hoisted above the goal-tool registration (rather than declared only inside the
             // worktreeSync-enabled block further below) so the SAME settings/deps factory backs both
             // the goal->tmux lane-first dispatch dep (`createLaneWorktree`, immediately below) and the
             // `worktree_sync` tool registration later in this method -- one source of truth, no drift.
-            const worktreeSyncSettings = settingsManager.getWorktreeSyncSettings();
+            const worktreeSyncSettings = toolAccess.allows("goal") || toolAccess.allows("worktree_sync")
+                ? settingsManager.getWorktreeSyncSettings()
+                : undefined;
             const worktreeSyncEngineDeps = () => buildWorktreeSyncEngineDeps({
                 cwd: this.deps.getCwd(),
                 agentDir: this.deps.getAgentDir(),
                 settingsManager: this.deps.getSettingsManager(),
                 sessionId: this.deps.getSessionManager().getSessionId(),
             });
-            const goalToolDefinition = createGoalToolDefinition({
-                getGoalState: () => this.deps.getGoalStateSnapshot(),
-                saveGoalState: (state) => {
-                    this.deps.saveGoalStateSnapshot(state);
-                },
-                // kind:"tool" evidence refs verify against real session records.
-                hasToolCallId: (toolCallId) => hasAnsweredToolCallOnBranch(this.deps.getSessionManager(), toolCallId),
-                // kind:"worker" evidence refs verify against the SAME live lane/result accessors the
-                // delegate_status tool already uses below -- live wiring (these were declared optional
-                // and read-defensive on the goal-tool deps type).
-                getLaneRecords: () => this.deps.getWorkerLaneRecords(),
-                getWorkerResultSnapshots: () => this.deps.getWorkerResultSnapshots(),
-                // dispatch_worker's tool-layer side effect for the default (in_process) route: starts a
-                // real in-process worker lane through the SAME starter the delegate tool uses (below),
-                // adapted from its `{started:true;record}|{started:false;skipReason}` shape onto this
-                // tool's narrower `{laneId}|{skipReason}` shape.
-                startWorkerDelegation: (args) => {
-                    const outcome = this.deps.startWorkerDelegation({ instructions: args.instructions });
-                    return outcome.started ? { laneId: outcome.record.laneId } : { skipReason: outcome.skipReason };
-                },
-                // dispatch_worker's tool-layer side effect for `dispatchTarget:"tmux"`: core structurally
-                // invokes the SAME tmux_agent_manager fire_task call the model itself would make (no
-                // extension change, no faked launch/laneId) -- see tmux-dispatch.ts's doc comment.
-                dispatchTmuxWorker: (args) => dispatchTmuxWorker({
-                    getToolDefinition: (name) => this.getToolDefinition(name),
-                    createExtensionContext: () => this.deps.getExtensionRunner().createContext(),
-                    resolveManagedLaneId: (id) => this.deps.resolveManagedLaneId(id),
-                    getGoalId: () => this.deps.getGoalStateSnapshot()?.goalId,
-                    evaluateWorkerLaneRefusal: () => this.deps.getLaneWorkerRefusal(),
-                    // Lane-first dispatch, wired ONLY when worktree-sync is enabled -- absent otherwise,
-                    // so a disabled/default session gets the existing byte-identical fire_task params.
-                    createLaneWorktree: worktreeSyncSettings.enabled
-                        ? async (laneArgs) => {
-                            const created = await createLane(worktreeSyncEngineDeps(), {
-                                ...(laneArgs.goalId !== undefined ? { goalId: laneArgs.goalId } : {}),
-                                requirementId: laneArgs.requirementId,
-                            });
-                            // Never fake a lane: any non-"ok" engine code (max lanes, invalid key, git
-                            // error, ...) is refused, mapped by the caller onto the stable
-                            // "worktree_create_failed" skip reason before any fire_task call runs.
-                            if (created.code !== "ok")
-                                return { skipReason: created.code };
-                            return { laneKey: created.lane.laneKey, worktreePath: created.lane.worktreePath };
-                        }
-                        : undefined,
-                }, args),
-                cwd: () => this.deps.getCwd(),
-                // Reuses the already branch-scoped getTaskStepsStateSnapshot dep -- no new
-                // SessionManager access needed for the cross-visibility nudge.
-                getOpenTaskSteps: () => deriveOpenTaskStepRefs(this.deps.getTaskStepsStateSnapshot()),
-            });
-            this._baseToolDefinitions.set(goalToolDefinition.name, goalToolDefinition);
-            const taskStepsToolDefinition = createTaskStepsToolDefinition({
-                getTaskStepsState: () => this.deps.getTaskStepsStateSnapshot(),
-                saveTaskStepsState: (state) => {
-                    this.deps.saveTaskStepsStateSnapshot(state);
-                },
-            });
-            this._baseToolDefinitions.set(taskStepsToolDefinition.name, taskStepsToolDefinition);
-            const delegateToolDefinition = createDelegateToolDefinition({
-                startWorkerDelegation: (args) => this.deps.startWorkerDelegation(args),
-                runWorkerDelegation: (args) => this.deps.runWorkerDelegationOnce(args),
-            });
-            const delegateStatusToolDefinition = createDelegateStatusToolDefinition({
-                getLaneRecords: () => this.deps.getWorkerLaneRecords(),
-                getWorkerResultSnapshots: () => this.deps.getWorkerResultSnapshots(),
-                // Durable ack persists straight through the session log; routed here (rather than
-                // a new agent-session dep) because getSessionManager() is already a stable, generic
-                // passthrough dep, so no other package needs to change for this to work.
-                acknowledgeWorkerReview: (requestId) => acknowledgeWorkerResultReview(this.deps.getSessionManager(), requestId),
-            });
-            this._baseToolDefinitions.set(delegateToolDefinition.name, delegateToolDefinition);
-            this._baseToolDefinitions.set(delegateStatusToolDefinition.name, delegateStatusToolDefinition);
+            if (toolAccess.allows("goal")) {
+                const goalToolDefinition = createGoalToolDefinition({
+                    getGoalState: () => this.deps.getGoalStateSnapshot(),
+                    saveGoalState: (state) => {
+                        this.deps.saveGoalStateSnapshot(state);
+                    },
+                    // kind:"tool" evidence refs verify against real session records.
+                    hasToolCallId: (toolCallId) => hasAnsweredToolCallOnBranch(this.deps.getSessionManager(), toolCallId),
+                    // kind:"worker" evidence refs verify against the SAME live lane/claim accessors the
+                    // delegate_status tool already uses below -- live wiring (these were declared optional
+                    // and read-defensive on the goal-tool deps type).
+                    getLaneRecords: () => this.deps.getWorkerLaneRecords(),
+                    getWorkerClaimSnapshots: () => this.deps.getWorkerClaimSnapshots(),
+                    // dispatch_worker's tool-layer side effect for the default (in_process) route: starts a
+                    // real in-process worker lane through the SAME starter the delegate tool uses (below),
+                    // adapted from its `{started:true;record}|{started:false;skipReason}` shape onto this
+                    // tool's narrower `{laneId}|{skipReason}` shape.
+                    startWorkerDelegation: (args) => {
+                        const outcome = this.deps.startWorkerDelegation({ instructions: args.instructions });
+                        return outcome.started ? { laneId: outcome.record.laneId } : { skipReason: outcome.skipReason };
+                    },
+                    // dispatch_worker's tool-layer side effect for `dispatchTarget:"tmux"`: core structurally
+                    // invokes the SAME tmux_agent_manager fire_task call the model itself would make (no
+                    // extension change, no faked launch/laneId) -- see tmux-dispatch.ts's doc comment.
+                    dispatchTmuxWorker: (args) => dispatchTmuxWorker({
+                        getToolDefinition: (name) => this.getToolDefinition(name),
+                        createExtensionContext: () => this.deps.getExtensionRunner().createContext(),
+                        resolveManagedLaneId: (id) => this.deps.resolveManagedLaneId(id),
+                        getGoalId: () => this.deps.getGoalStateSnapshot()?.goalId,
+                        evaluateWorkerLaneRefusal: () => this.deps.getLaneWorkerRefusal(),
+                        // Lane-first dispatch, wired ONLY when worktree-sync is enabled -- absent otherwise,
+                        // so a disabled/default session gets the existing byte-identical fire_task params.
+                        createLaneWorktree: worktreeSyncSettings?.enabled
+                            ? async (laneArgs) => {
+                                const created = await createLane(worktreeSyncEngineDeps(), {
+                                    ...(laneArgs.goalId !== undefined ? { goalId: laneArgs.goalId } : {}),
+                                    requirementId: laneArgs.requirementId,
+                                });
+                                // Never fake a lane: any non-"ok" engine code (max lanes, invalid key, git
+                                // error, ...) is refused, mapped by the caller onto the stable
+                                // "worktree_create_failed" skip reason before any fire_task call runs.
+                                if (created.code !== "ok")
+                                    return { skipReason: created.code };
+                                return { laneKey: created.lane.laneKey, worktreePath: created.lane.worktreePath };
+                            }
+                            : undefined,
+                    }, args),
+                    cwd: () => this.deps.getCwd(),
+                    // Reuses the already branch-scoped getTaskStepsStateSnapshot dep -- no new
+                    // SessionManager access needed for the cross-visibility nudge.
+                    getOpenTaskSteps: () => deriveOpenTaskStepRefs(this.deps.getTaskStepsStateSnapshot()),
+                });
+                this._baseToolDefinitions.set(goalToolDefinition.name, goalToolDefinition);
+            }
+            if (toolAccess.allows("task_steps")) {
+                const taskStepsToolDefinition = createTaskStepsToolDefinition({
+                    getTaskStepsState: () => this.deps.getTaskStepsStateSnapshot(),
+                    saveTaskStepsState: (state) => {
+                        this.deps.saveTaskStepsStateSnapshot(state);
+                    },
+                });
+                this._baseToolDefinitions.set(taskStepsToolDefinition.name, taskStepsToolDefinition);
+            }
+            if (toolAccess.allows("ask_question")) {
+                const askQuestionToolDefinition = createAskQuestionToolDefinition({
+                    sessionManager: this.deps.getSessionManager(),
+                    artifactStore: toolArtifactStore,
+                    getImageStore: () => this.deps.getSessionImageStore(),
+                });
+                this._baseToolDefinitions.set(askQuestionToolDefinition.name, askQuestionToolDefinition);
+            }
+            if (toolAccess.allows("delegate")) {
+                const delegateToolDefinition = createDelegateToolDefinition({
+                    startWorkerDelegation: (args) => this.deps.startWorkerDelegation(args),
+                    runWorkerDelegation: (args) => this.deps.runWorkerDelegationOnce(args),
+                    orchestrationProfiles: this.deps.getOrchestrationProfileCatalog(),
+                });
+                this._baseToolDefinitions.set(delegateToolDefinition.name, delegateToolDefinition);
+            }
+            if (toolAccess.allows("delegate_status")) {
+                const delegateStatusToolDefinition = createDelegateStatusToolDefinition({
+                    getLaneRecords: () => this.deps.getWorkerLaneRecords(),
+                    getWorkerClaimSnapshots: () => this.deps.getWorkerClaimSnapshots(),
+                    // Durable ack persists straight through the session log; routed here (rather than
+                    // a new agent-session dep) because getSessionManager() is already a stable, generic
+                    // passthrough dep, so no other package needs to change for this to work.
+                    acknowledgeWorkerReview: (requestId) => acknowledgeWorkerClaimReview(this.deps.getSessionManager(), requestId),
+                });
+                this._baseToolDefinitions.set(delegateStatusToolDefinition.name, delegateStatusToolDefinition);
+            }
             // Registered but not default-active: probes spend tokens on the probed model, so
             // activation is an explicit choice (settings/profile/setActiveTools or /autonomy fitness).
-            const modelFitnessToolDefinition = createModelFitnessToolDefinition({
-                runProbe: (args) => this.deps.runModelFitness(args),
-            });
-            this._baseToolDefinitions.set(modelFitnessToolDefinition.name, modelFitnessToolDefinition);
-            if (settingsManager.getScoutSettings().enabled) {
+            if (toolAccess.allows("model_fitness")) {
+                const modelFitnessToolDefinition = createModelFitnessToolDefinition({
+                    runProbe: (args) => this.deps.runModelFitness(args),
+                });
+                this._baseToolDefinitions.set(modelFitnessToolDefinition.name, modelFitnessToolDefinition);
+            }
+            if (toolAccess.allows("context_scout") && settingsManager.getScoutSettings().enabled) {
                 const contextScoutToolDefinition = createContextScoutToolDefinition({
                     runScout: (input) => this._runContextScout(input.query, input.maxTurns, toolArtifactStore),
                 });
                 this._baseToolDefinitions.set(contextScoutToolDefinition.name, contextScoutToolDefinition);
             }
-            const runToolkitScriptToolDefinition = createRunToolkitScriptToolDefinition({
-                getScripts: () => this.deps.getSettingsManager().getToolkitScripts(),
-                execute: (script, scriptArgs) => executeToolkitScript({ script, scriptArgs, cwd: this.deps.getCwd() }),
-                artifactStore: toolArtifactStore,
-                // Reflex brain (fitness-gated local model): resolves ambiguous requests into a
-                // registry pick. Best-effort — absent/unfit brain keeps the shortlist behavior.
-                interpret: async (request, scripts) => {
-                    const model = this.deps.resolveCurationModelIfFit();
-                    if (!model)
-                        return undefined;
-                    const completion = await this.deps.runIsolatedCompletion({
-                        systemPrompt: REFLEX_INTERPRETER_SYSTEM_PROMPT,
-                        messages: [
-                            {
-                                role: "user",
-                                content: [{ type: "text", text: buildReflexUserPrompt(request, scripts) }],
-                                timestamp: Date.now(),
-                            },
-                        ],
-                        model,
-                        thinkingLevel: "off",
-                        maxTokens: 256,
-                        cacheRetention: "short",
-                        // Stable per-lane synthetic affinity key so repeat ambiguous-request
-                        // interpretations hit the same cache-warm backend.
-                        laneKind: "toolkit-brain",
-                    });
-                    if (completion.usage.cost.total > 0 || completion.usage.totalTokens > 0) {
-                        // `reportId` keyed on the ambiguous request text driving THIS interpretation —
-                        // stable across a retry of the same tool call, distinct across genuinely
-                        // different requests.
-                        const reportId = deriveSpawnedUsageReportId("toolkit-brain", this.deps.getSessionManager().getSessionId(), request);
-                        this.deps.addSpawnedUsage(completion.usage, { label: "toolkit-brain", reportId });
-                    }
-                    return parseReflexPlan(completion.text);
-                },
-            });
-            this._baseToolDefinitions.set(runToolkitScriptToolDefinition.name, runToolkitScriptToolDefinition);
+            if (toolAccess.allows("run_toolkit_script")) {
+                const runToolkitScriptToolDefinition = createRunToolkitScriptToolDefinition({
+                    getScripts: () => this.deps.getSettingsManager().getToolkitScripts(),
+                    execute: (script, scriptArgs) => executeToolkitScript({ script, scriptArgs, cwd: this.deps.getCwd() }),
+                    artifactStore: toolArtifactStore,
+                    // Reflex brain (fitness-gated local model): resolves ambiguous requests into a
+                    // registry pick. Best-effort — absent/unfit brain keeps the shortlist behavior.
+                    interpret: async (request, scripts) => {
+                        const model = this.deps.resolveCurationModelIfFit();
+                        if (!model)
+                            return undefined;
+                        const completion = await this.deps.runIsolatedCompletion({
+                            systemPrompt: REFLEX_INTERPRETER_SYSTEM_PROMPT,
+                            messages: [
+                                {
+                                    role: "user",
+                                    content: [{ type: "text", text: buildReflexUserPrompt(request, scripts) }],
+                                    timestamp: Date.now(),
+                                },
+                            ],
+                            model,
+                            thinkingLevel: "off",
+                            maxTokens: 256,
+                            cacheRetention: "short",
+                            // Stable per-lane synthetic affinity key so repeat ambiguous-request
+                            // interpretations hit the same cache-warm backend.
+                            laneKind: "toolkit-brain",
+                        });
+                        if (completion.usage.cost.total > 0 || completion.usage.totalTokens > 0) {
+                            // `reportId` keyed on the ambiguous request text driving THIS interpretation —
+                            // stable across a retry of the same tool call, distinct across genuinely
+                            // different requests.
+                            const reportId = deriveSpawnedUsageReportId("toolkit-brain", this.deps.getSessionManager().getSessionId(), request);
+                            this.deps.addSpawnedUsage(completion.usage, { label: "toolkit-brain", reportId });
+                        }
+                        return parseReflexPlan(completion.text);
+                    },
+                });
+                this._baseToolDefinitions.set(runToolkitScriptToolDefinition.name, runToolkitScriptToolDefinition);
+            }
             // Worktree-sync (opt-in): the closed-action lane workflow tool, plus -- for a session
             // launched lane-bound (PI_WORKTREE_LANE) -- the G8/G10 lane gate wrapped UNDER the
             // file-mutation tools (edit/write, plus cooperative bash only for interactive lanes), so a sync_required lane fails closed with the
             // exact recovery step rather than relying on prompt compliance. `worktreeSyncSettings` /
             // `worktreeSyncEngineDeps` are hoisted above (declared before the goal-tool registration)
             // so the goal->tmux lane-first dispatch dep and this tool share one settings/deps source.
-            if (worktreeSyncSettings.enabled) {
+            if (toolAccess.allows("worktree_sync") && worktreeSyncSettings?.enabled) {
                 const worktreeSyncToolDefinition = createWorktreeSyncToolDefinition({
                     engineDeps: worktreeSyncEngineDeps,
                     settings: () => this.deps.getSettingsManager().getWorktreeSyncSettings(),
@@ -877,6 +933,9 @@ export class RuntimeBuilder {
      */
     async loadExtensionLive(extensionPath) {
         this._assertReloadQuiescent("load extension");
+        if (!this.deps.getSettingsManager().isResourceAllowedByProfile("extensions", extensionPath)) {
+            throw new Error(`Cannot load extension outside the active resource profile: ${extensionPath}`);
+        }
         const previousRunner = this.deps.getExtensionRunner();
         try {
             // Load the extension with fresh import