@caupulican/pi-adaptative 0.81.39 → 0.81.41

package/dist/core/runtime-builder.js

@@ -36,7 +36,7 @@ import { createHash } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { isAbsolute, join } from "node:path";
 import { DEFAULT_ACTIVE_TOOL_NAMES, mapToolNamesForPlatform } from "./default-tool-surface.js";
-import { acknowledgeWorkerResultReview } from "./delegation/session-worker-result.js";
+import { acknowledgeWorkerClaimReview } from "./delegation/session-worker-claim.js";
 import { createCoreDiagnosticsToolDefinitions } from "./extensions/builtin.js";
 import { ExtensionRunner, wrapRegisteredTools, } from "./extensions/index.js";
 import { disposeExtensionEventSubscriptions } from "./extensions/loader.js";
@@ -46,25 +46,33 @@ import { evaluateSurfaceFitness } from "./model-router/fitness-gate.js";
 import { FitnessStore } from "./models/fitness-store.js";
 import { describeInFlightWorkUnit, getInFlightWorkUnits } from "./reload-blockers.js";
 import { ScoutController } from "./scout-controller.js";
+import { wrapToolWithCredentialExposureGuard } from "./secrets/credential-exposure-guard.js";
+import { SecretVault } from "./secrets/secret-vault.js";
 import { getSessionRole, isWorkerSession, WORKER_FORBIDDEN_TOOLS } from "./session-role.js";
 import { matchesResourceProfilePattern, } from "./settings-manager.js";
 import { createSyntheticSourceInfo } from "./source-info.js";
+import { projectOpenTaskSteps } from "./tasks/task-projection.js";
 import { buildReflexUserPrompt, parseReflexPlan, REFLEX_INTERPRETER_SYSTEM_PROMPT, } from "./toolkit/reflex-interpreter.js";
 import { executeToolkitScript } from "./toolkit/script-runner.js";
+import { createAskQuestionToolDefinition } from "./tools/ask-question.js";
 import { createContextScoutToolDefinition } from "./tools/context-scout.js";
 import { createDelegateToolDefinition } from "./tools/delegate.js";
 import { createDelegateStatusToolDefinition } from "./tools/delegate-status.js";
 import { createFindTool } from "./tools/find.js";
 import { createGoalToolDefinition } from "./tools/goal.js";
 import { createGrepTool } from "./tools/grep.js";
-import { createAllToolDefinitions } from "./tools/index.js";
+import { allToolNames, createToolDefinition } from "./tools/index.js";
 import { createModelFitnessToolDefinition } from "./tools/model-fitness.js";
 import { resolveToCwd } from "./tools/path-utils.js";
 import { createReadTool } from "./tools/read.js";
+import { createRunProcessToolDefinition } from "./tools/run-process.js";
 import { createRunToolkitScriptToolDefinition } from "./tools/run-toolkit-script.js";
+import { createSecretStoreToolDefinition } from "./tools/secret-store.js";
+import { disposePersistentShellSession } from "./tools/shell-session.js";
 import { createTaskStepsToolDefinition } from "./tools/task-steps.js";
 import { dispatchTmuxWorker } from "./tools/tmux-dispatch.js";
 import { createToolDefinitionFromAgentTool } from "./tools/tool-definition-wrapper.js";
+import { disposeWindowsShellState } from "./tools/windows-shell-state.js";
 import { createWorktreeSyncToolDefinition } from "./tools/worktree-sync.js";
 import { createLane } from "./worktree-sync/git-engine.js";
 import { WorktreeLaneGate } from "./worktree-sync/lane-gate.js";
@@ -93,16 +101,15 @@ export function hasAnsweredToolCallOnBranch(sessionManager, toolCallId) {
         .some((entry) => entry.type === "message" && entry.message.role === "toolResult" && entry.message.toolCallId === toolCallId);
 }
 /**
- * Project a task-steps snapshot down to the OPEN (non-terminal) steps the goal tool's
- * cross-visibility nudge needs. Mirrors `goal-runtime-snapshot.ts`'s `openTaskSteps` filter
- * (status not "completed"/"cancelled", `activeForm || content`) so the two read the same
- * "open" definition, narrowed to `OpenTaskStepRef`'s id+content shape. Exported (pure, no
- * `this`) so the goal tool's `getOpenTaskSteps` wiring below is directly testable.
+ * Goal-tool adapter over the canonical open-task projection. Exported (pure, no `this`) so the
+ * production `getOpenTaskSteps` wiring below remains directly testable without another filter.
  */
 export function deriveOpenTaskStepRefs(taskStepsState) {
-    return (taskStepsState?.steps ?? [])
-        .filter((step) => step.status !== "completed" && step.status !== "cancelled")
-        .map((step) => ({ id: step.id, content: step.activeForm || step.content }));
+    return projectOpenTaskSteps(taskStepsState).map((step) => ({
+        id: step.id,
+        content: step.content,
+        ...(step.requirementIds?.length ? { requirementIds: step.requirementIds } : {}),
+    }));
 }
 /**
  * Owns the tool-registry build and the self-modification-safe extension reload extracted from
@@ -115,11 +122,66 @@ export class RuntimeBuilder {
     _toolPromptSnippets = new Map();
     _toolPromptGuidelines = new Map();
     _baseToolDefinitions = new Map();
+    /** Exact extensions the owner approved through the live-load API. Discovery never populates this set. */
+    _explicitLiveExtensionPaths = new Set();
     _reloadPromise;
     _reloadRequested = false;
+    _secretVault;
     deps;
     constructor(deps) {
         this.deps = deps;
+        this._secretVault = new SecretVault({
+            agentDir: deps.getAgentDir(),
+            onEnvironmentChanged: () => {
+                const sessionKey = deps.getShellSessionKey();
+                disposePersistentShellSession(sessionKey);
+                disposeWindowsShellState(sessionKey);
+            },
+        });
+    }
+    /**
+     * Resolve the construction and activation policy once for a runtime generation. This is the
+     * UAC choke point: callers must consult it before invoking a tool factory, not merely before
+     * placing an already-created definition in the live registry.
+     */
+    _createToolAccessPolicy() {
+        const role = getSessionRole();
+        const configuredAllowedToolNames = this.deps.getAllowedToolNames();
+        const allowedToolNames = configuredAllowedToolNames
+            ? new Set(mapToolNamesForPlatform([...configuredAllowedToolNames]))
+            : undefined;
+        const configuredExcludedToolNames = this.deps.getExcludedToolNames();
+        const excludedToolNames = configuredExcludedToolNames
+            ? new Set(mapToolNamesForPlatform([...configuredExcludedToolNames]))
+            : undefined;
+        const configuredToolProfileFilter = this.deps.getToolProfileFilter();
+        const toolProfileFilter = configuredToolProfileFilter
+            ? {
+                allow: mapToolNamesForPlatform(configuredToolProfileFilter.allow),
+                block: mapToolNamesForPlatform(configuredToolProfileFilter.block),
+            }
+            : undefined;
+        return {
+            allowedToolNames,
+            toolProfileFilter,
+            allows: (name) => {
+                // Strict worker UAC ceiling wins over every explicit grant.
+                if (role === "worker" && WORKER_FORBIDDEN_TOOLS.has(name))
+                    return false;
+                if (allowedToolNames && !allowedToolNames.has(name))
+                    return false;
+                if (excludedToolNames?.has(name))
+                    return false;
+                if (!toolProfileFilter)
+                    return true;
+                if (toolProfileFilter.allow.length > 0 && !matchesResourceProfilePattern(name, toolProfileFilter.allow)) {
+                    return false;
+                }
+                if (matchesResourceProfilePattern(name, toolProfileFilter.block))
+                    return false;
+                return true;
+            },
+        };
     }
     async _runContextScout(query, maxTurns, artifactStore) {
         const cwd = this.deps.getCwd();
@@ -127,9 +189,9 @@ export class RuntimeBuilder {
             resolveScoutModel: async () => resolveScoutModel(this.deps.getModelRegistry(), this.deps.getSettingsManager().getScoutSettings().model, this.deps.getAgentDir(), (model) => this.deps.isModelExhausted(model)),
             getCwd: () => cwd,
             buildReadOnlyTools: (toolCwd) => [
-                createReadTool(toolCwd),
-                createGrepTool(toolCwd, { artifactStore }),
-                createFindTool(toolCwd, { artifactStore }),
+                wrapToolWithCredentialExposureGuard(createReadTool(toolCwd), toolCwd, this._secretVault),
+                wrapToolWithCredentialExposureGuard(createGrepTool(toolCwd, { artifactStore }), toolCwd, this._secretVault),
+                wrapToolWithCredentialExposureGuard(createFindTool(toolCwd, { artifactStore }), toolCwd, this._secretVault),
             ],
             streamFn: this.deps.getAgent().streamFn,
             fileExists: (path) => existsSync(resolveCwdPath(cwd, path)),
@@ -172,46 +234,14 @@ export class RuntimeBuilder {
         return this._toolDefinitions.get(name)?.definition;
     }
     refreshToolRegistry(options) {
-        const role = getSessionRole();
         const previousRegistryNames = new Set(this._toolRegistry.keys());
         // Re-derive from the pre-filter REQUEST, never from agent.state.tools: the active set is
         // capability/profile-filtered, so feeding it back through setActiveToolsByName would
         // permanently shrink what a later switch to a larger model (or permissive profile) restores.
         const previousActiveToolNames = mapToolNamesForPlatform(this.deps.getRequestedActiveToolNames() ?? this.deps.getActiveToolNames());
-        const configuredAllowedToolNames = this.deps.getAllowedToolNames();
-        const allowedToolNames = configuredAllowedToolNames
-            ? new Set(mapToolNamesForPlatform([...configuredAllowedToolNames]))
-            : undefined;
-        const configuredExcludedToolNames = this.deps.getExcludedToolNames();
-        const excludedToolNames = configuredExcludedToolNames
-            ? new Set(mapToolNamesForPlatform([...configuredExcludedToolNames]))
-            : undefined;
-        const configuredToolProfileFilter = this.deps.getToolProfileFilter();
-        const toolProfileFilter = configuredToolProfileFilter
-            ? {
-                allow: mapToolNamesForPlatform(configuredToolProfileFilter.allow),
-                block: mapToolNamesForPlatform(configuredToolProfileFilter.block),
-            }
-            : undefined;
-        const isAllowedTool = (name) => {
-            // Strict worker UAC ceiling: wins over allow-list/exclude/profile -- a worker session
-            // (lane-bound or dispatched) can never activate this tool no matter how permissively the
-            // active profile or an explicit request names it. See session-role.ts.
-            if (role === "worker" && WORKER_FORBIDDEN_TOOLS.has(name))
-                return false;
-            if (allowedToolNames && !allowedToolNames.has(name))
-                return false;
-            if (excludedToolNames?.has(name))
-                return false;
-            if (!toolProfileFilter)
-                return true;
-            if (toolProfileFilter.allow.length > 0 && !matchesResourceProfilePattern(name, toolProfileFilter.allow)) {
-                return false;
-            }
-            if (matchesResourceProfilePattern(name, toolProfileFilter.block))
-                return false;
-            return true;
-        };
+        const toolAccess = this._createToolAccessPolicy();
+        const { allowedToolNames, toolProfileFilter } = toolAccess;
+        const isAllowedTool = toolAccess.allows;
         const registeredTools = this.deps.getExtensionRunner().getAllRegisteredTools();
         const allCustomTools = [
             ...registeredTools,
@@ -264,9 +294,13 @@ export class RuntimeBuilder {
             definition,
             sourceInfo: createSyntheticSourceInfo(`<builtin:${definition.name}>`, { source: "builtin" }),
         })), runner);
-        const toolRegistry = new Map(wrappedBuiltInTools.map((tool) => [tool.name, tool]));
+        const toolRegistry = new Map(wrappedBuiltInTools.map((tool) => {
+            const guarded = wrapToolWithCredentialExposureGuard(tool, this.deps.getCwd(), this._secretVault);
+            return [guarded.name, guarded];
+        }));
         for (const tool of wrappedExtensionTools) {
-            toolRegistry.set(tool.name, tool);
+            const guarded = wrapToolWithCredentialExposureGuard(tool, this.deps.getCwd(), this._secretVault);
+            toolRegistry.set(guarded.name, guarded);
         }
         this._toolRegistry = toolRegistry;
         const requestedBase = options?.activeToolNames
@@ -425,169 +459,220 @@ export class RuntimeBuilder {
         const shellCommandPrefix = settingsManager.getShellCommandPrefix();
         const shellPath = settingsManager.getShellPath();
         const baseToolsOverride = this.deps.getBaseToolsOverride();
+        const toolAccess = this._createToolAccessPolicy();
         // Artifact-producing tools must not emit a "Full output: artifact tool-output:<id>" handle
         // that nothing can resolve. If artifact_retrieve is explicitly excluded/blocked/outside
         // an active allowlist, don't hand grep/find/run_toolkit_script an artifact store at all:
         // they fall back to their bounded preview/truncation behavior, with no payload/meta files
         // ever written and no retrieval promise made.
-        const toolArtifactStore = this.deps.isToolOrCommandAllowedByProfile("artifact_retrieve")
-            ? this.deps.getToolArtifactStore()
-            : undefined;
-        const baseToolDefinitions = baseToolsOverride
-            ? Object.fromEntries(Object.entries(baseToolsOverride).map(([name, tool]) => [name, createToolDefinitionFromAgentTool(tool)]))
-            : createAllToolDefinitions(this.deps.getCwd(), {
-                read: { autoResizeImages },
-                bash: { commandPrefix: shellCommandPrefix, shellPath, sessionKey: this.deps.getShellSessionKey() },
-                grep: { artifactStore: toolArtifactStore },
-                find: { artifactStore: toolArtifactStore },
-                artifact_retrieve: { artifactStore: toolArtifactStore },
-            });
-        this._baseToolDefinitions = new Map(Object.entries(baseToolDefinitions).map(([name, tool]) => [name, tool]));
+        const toolArtifactStore = !baseToolsOverride && toolAccess.allows("artifact_retrieve") ? this.deps.getToolArtifactStore() : undefined;
+        const toolOptions = {
+            read: { autoResizeImages },
+            bash: {
+                commandPrefix: shellCommandPrefix,
+                shellPath,
+                sessionKey: this.deps.getShellSessionKey(),
+                platform: process.platform,
+                spawnHook: (context) => ({
+                    ...context,
+                    env: { ...context.env, ...this._secretVault.getEnvironmentForCwd(context.cwd) },
+                }),
+            },
+            python: { environment: (cwd) => this._secretVault.getEnvironmentForCwd(cwd) },
+            grep: { artifactStore: toolArtifactStore },
+            find: { artifactStore: toolArtifactStore },
+            artifact_retrieve: { artifactStore: toolArtifactStore },
+        };
+        this._baseToolDefinitions = baseToolsOverride
+            ? new Map(Object.entries(baseToolsOverride)
+                .filter(([name]) => toolAccess.allows(name))
+                .map(([name, tool]) => [name, createToolDefinitionFromAgentTool(tool)]))
+            : new Map([...allToolNames]
+                .filter((name) => toolAccess.allows(name))
+                .map((name) => [name, createToolDefinition(name, this.deps.getCwd(), toolOptions)]));
         if (!baseToolsOverride) {
-            for (const definition of createCoreDiagnosticsToolDefinitions(() => this.deps.getActiveToolNames(), () => this.getAllTools(), (messages) => this.deps.getContextGcReport(messages), () => this.deps.getMemoryAuditDiagnostics())) {
-                this._baseToolDefinitions.set(definition.name, definition);
+            if (toolAccess.allows("run_process")) {
+                const orchestrationProfile = this.deps.getOrchestrationProfile?.();
+                if (orchestrationProfile?.executionPolicy) {
+                    this._baseToolDefinitions.set("run_process", createRunProcessToolDefinition(this.deps.getCwd(), {
+                        policy: orchestrationProfile.executionPolicy,
+                        maxWallClockMs: orchestrationProfile.budget.maxWallClockMs ?? 0,
+                    }));
+                }
+            }
+            if (toolAccess.allows("context_audit")) {
+                for (const definition of createCoreDiagnosticsToolDefinitions(() => this.deps.getActiveToolNames(), () => this.getAllTools(), (messages) => this.deps.getContextGcReport(messages), () => this.deps.getMemoryAuditDiagnostics())) {
+                    this._baseToolDefinitions.set(definition.name, definition);
+                }
             }
             // Hoisted above the goal-tool registration (rather than declared only inside the
             // worktreeSync-enabled block further below) so the SAME settings/deps factory backs both
             // the goal->tmux lane-first dispatch dep (`createLaneWorktree`, immediately below) and the
             // `worktree_sync` tool registration later in this method -- one source of truth, no drift.
-            const worktreeSyncSettings = settingsManager.getWorktreeSyncSettings();
+            const worktreeSyncSettings = toolAccess.allows("goal") || toolAccess.allows("worktree_sync")
+                ? settingsManager.getWorktreeSyncSettings()
+                : undefined;
             const worktreeSyncEngineDeps = () => buildWorktreeSyncEngineDeps({
                 cwd: this.deps.getCwd(),
                 agentDir: this.deps.getAgentDir(),
                 settingsManager: this.deps.getSettingsManager(),
                 sessionId: this.deps.getSessionManager().getSessionId(),
             });
-            const goalToolDefinition = createGoalToolDefinition({
-                getGoalState: () => this.deps.getGoalStateSnapshot(),
-                saveGoalState: (state) => {
-                    this.deps.saveGoalStateSnapshot(state);
-                },
-                // kind:"tool" evidence refs verify against real session records.
-                hasToolCallId: (toolCallId) => hasAnsweredToolCallOnBranch(this.deps.getSessionManager(), toolCallId),
-                // kind:"worker" evidence refs verify against the SAME live lane/result accessors the
-                // delegate_status tool already uses below -- live wiring (these were declared optional
-                // and read-defensive on the goal-tool deps type).
-                getLaneRecords: () => this.deps.getWorkerLaneRecords(),
-                getWorkerResultSnapshots: () => this.deps.getWorkerResultSnapshots(),
-                // dispatch_worker's tool-layer side effect for the default (in_process) route: starts a
-                // real in-process worker lane through the SAME starter the delegate tool uses (below),
-                // adapted from its `{started:true;record}|{started:false;skipReason}` shape onto this
-                // tool's narrower `{laneId}|{skipReason}` shape.
-                startWorkerDelegation: (args) => {
-                    const outcome = this.deps.startWorkerDelegation({ instructions: args.instructions });
-                    return outcome.started ? { laneId: outcome.record.laneId } : { skipReason: outcome.skipReason };
-                },
-                // dispatch_worker's tool-layer side effect for `dispatchTarget:"tmux"`: core structurally
-                // invokes the SAME tmux_agent_manager fire_task call the model itself would make (no
-                // extension change, no faked launch/laneId) -- see tmux-dispatch.ts's doc comment.
-                dispatchTmuxWorker: (args) => dispatchTmuxWorker({
-                    getToolDefinition: (name) => this.getToolDefinition(name),
-                    createExtensionContext: () => this.deps.getExtensionRunner().createContext(),
-                    resolveManagedLaneId: (id) => this.deps.resolveManagedLaneId(id),
-                    getGoalId: () => this.deps.getGoalStateSnapshot()?.goalId,
-                    evaluateWorkerLaneRefusal: () => this.deps.getLaneWorkerRefusal(),
-                    // Lane-first dispatch, wired ONLY when worktree-sync is enabled -- absent otherwise,
-                    // so a disabled/default session gets the existing byte-identical fire_task params.
-                    createLaneWorktree: worktreeSyncSettings.enabled
-                        ? async (laneArgs) => {
-                            const created = await createLane(worktreeSyncEngineDeps(), {
-                                ...(laneArgs.goalId !== undefined ? { goalId: laneArgs.goalId } : {}),
-                                requirementId: laneArgs.requirementId,
-                            });
-                            // Never fake a lane: any non-"ok" engine code (max lanes, invalid key, git
-                            // error, ...) is refused, mapped by the caller onto the stable
-                            // "worktree_create_failed" skip reason before any fire_task call runs.
-                            if (created.code !== "ok")
-                                return { skipReason: created.code };
-                            return { laneKey: created.lane.laneKey, worktreePath: created.lane.worktreePath };
-                        }
-                        : undefined,
-                }, args),
-                cwd: () => this.deps.getCwd(),
-                // Reuses the already branch-scoped getTaskStepsStateSnapshot dep -- no new
-                // SessionManager access needed for the cross-visibility nudge.
-                getOpenTaskSteps: () => deriveOpenTaskStepRefs(this.deps.getTaskStepsStateSnapshot()),
-            });
-            this._baseToolDefinitions.set(goalToolDefinition.name, goalToolDefinition);
-            const taskStepsToolDefinition = createTaskStepsToolDefinition({
-                getTaskStepsState: () => this.deps.getTaskStepsStateSnapshot(),
-                saveTaskStepsState: (state) => {
-                    this.deps.saveTaskStepsStateSnapshot(state);
-                },
-            });
-            this._baseToolDefinitions.set(taskStepsToolDefinition.name, taskStepsToolDefinition);
-            const delegateToolDefinition = createDelegateToolDefinition({
-                startWorkerDelegation: (args) => this.deps.startWorkerDelegation(args),
-                runWorkerDelegation: (args) => this.deps.runWorkerDelegationOnce(args),
-            });
-            const delegateStatusToolDefinition = createDelegateStatusToolDefinition({
-                getLaneRecords: () => this.deps.getWorkerLaneRecords(),
-                getWorkerResultSnapshots: () => this.deps.getWorkerResultSnapshots(),
-                // Durable ack persists straight through the session log; routed here (rather than
-                // a new agent-session dep) because getSessionManager() is already a stable, generic
-                // passthrough dep, so no other package needs to change for this to work.
-                acknowledgeWorkerReview: (requestId) => acknowledgeWorkerResultReview(this.deps.getSessionManager(), requestId),
-            });
-            this._baseToolDefinitions.set(delegateToolDefinition.name, delegateToolDefinition);
-            this._baseToolDefinitions.set(delegateStatusToolDefinition.name, delegateStatusToolDefinition);
+            if (toolAccess.allows("goal")) {
+                const goalToolDefinition = createGoalToolDefinition({
+                    getGoalState: () => this.deps.getGoalStateSnapshot(),
+                    saveGoalState: (state, expected) => {
+                        this.deps.saveGoalStateSnapshot(state, expected);
+                    },
+                    // kind:"tool" evidence refs verify against real session records.
+                    hasToolCallId: (toolCallId) => hasAnsweredToolCallOnBranch(this.deps.getSessionManager(), toolCallId),
+                    // kind:"worker" evidence refs verify against the SAME live lane/claim accessors the
+                    // delegate_status tool already uses below -- live wiring (these were declared optional
+                    // and read-defensive on the goal-tool deps type).
+                    getLaneRecords: () => this.deps.getWorkerLaneRecords(),
+                    getWorkerClaimSnapshots: () => this.deps.getWorkerClaimSnapshots(),
+                    // dispatch_worker's tool-layer side effect for the default (in_process) route: starts a
+                    // real in-process worker lane through the SAME starter the delegate tool uses (below),
+                    // adapted from its `{started:true;record}|{started:false;skipReason}` shape onto this
+                    // tool's narrower `{laneId}|{skipReason}` shape.
+                    startWorkerDelegation: (args) => {
+                        const outcome = this.deps.startWorkerDelegation({ instructions: args.instructions });
+                        return outcome.started ? { laneId: outcome.record.laneId } : { skipReason: outcome.skipReason };
+                    },
+                    // dispatch_worker's tool-layer side effect for `dispatchTarget:"tmux"`: core structurally
+                    // invokes the SAME tmux_agent_manager fire_task call the model itself would make (no
+                    // extension change, no faked launch/laneId) -- see tmux-dispatch.ts's doc comment.
+                    dispatchTmuxWorker: (args) => dispatchTmuxWorker({
+                        getToolDefinition: (name) => this.getToolDefinition(name),
+                        createExtensionContext: () => this.deps.getExtensionRunner().createContext(),
+                        resolveManagedLaneId: (id) => this.deps.resolveManagedLaneId(id),
+                        getGoalId: () => this.deps.getGoalStateSnapshot()?.goalId,
+                        evaluateWorkerLaneRefusal: () => this.deps.getLaneWorkerRefusal(),
+                        // Lane-first dispatch, wired ONLY when worktree-sync is enabled -- absent otherwise,
+                        // so a disabled/default session gets the existing byte-identical fire_task params.
+                        createLaneWorktree: worktreeSyncSettings?.enabled
+                            ? async (laneArgs) => {
+                                const created = await createLane(worktreeSyncEngineDeps(), {
+                                    ...(laneArgs.goalId !== undefined ? { goalId: laneArgs.goalId } : {}),
+                                    requirementId: laneArgs.requirementId,
+                                });
+                                // Never fake a lane: any non-"ok" engine code (max lanes, invalid key, git
+                                // error, ...) is refused, mapped by the caller onto the stable
+                                // "worktree_create_failed" skip reason before any fire_task call runs.
+                                if (created.code !== "ok")
+                                    return { skipReason: created.code };
+                                return { laneKey: created.lane.laneKey, worktreePath: created.lane.worktreePath };
+                            }
+                            : undefined,
+                    }, args),
+                    cwd: () => this.deps.getCwd(),
+                    // Reuses the already branch-scoped getTaskStepsStateSnapshot dep -- no new
+                    // SessionManager access needed for the cross-visibility nudge.
+                    getOpenTaskSteps: () => deriveOpenTaskStepRefs(this.deps.getTaskStepsStateSnapshot()),
+                });
+                this._baseToolDefinitions.set(goalToolDefinition.name, goalToolDefinition);
+            }
+            if (toolAccess.allows("task_steps")) {
+                const taskStepsToolDefinition = createTaskStepsToolDefinition({
+                    getTaskStepsState: () => this.deps.getTaskStepsStateSnapshot(),
+                    saveTaskStepsState: (state) => {
+                        this.deps.saveTaskStepsStateSnapshot(state);
+                    },
+                });
+                this._baseToolDefinitions.set(taskStepsToolDefinition.name, taskStepsToolDefinition);
+            }
+            if (toolAccess.allows("ask_question")) {
+                const askQuestionToolDefinition = createAskQuestionToolDefinition({
+                    sessionManager: this.deps.getSessionManager(),
+                    artifactStore: toolArtifactStore,
+                    getImageStore: () => this.deps.getSessionImageStore(),
+                });
+                this._baseToolDefinitions.set(askQuestionToolDefinition.name, askQuestionToolDefinition);
+            }
+            if (toolAccess.allows("secret_store")) {
+                const secretStoreToolDefinition = createSecretStoreToolDefinition({ vault: this._secretVault });
+                this._baseToolDefinitions.set(secretStoreToolDefinition.name, secretStoreToolDefinition);
+            }
+            if (toolAccess.allows("delegate")) {
+                const delegateToolDefinition = createDelegateToolDefinition({
+                    startWorkerDelegation: (args) => this.deps.startWorkerDelegation(args),
+                    runWorkerDelegation: (args) => this.deps.runWorkerDelegationOnce(args),
+                    orchestrationProfiles: this.deps.getOrchestrationProfileCatalog(),
+                });
+                this._baseToolDefinitions.set(delegateToolDefinition.name, delegateToolDefinition);
+            }
+            if (toolAccess.allows("delegate_status")) {
+                const delegateStatusToolDefinition = createDelegateStatusToolDefinition({
+                    getLaneRecords: () => this.deps.getWorkerLaneRecords(),
+                    getWorkerClaimSnapshots: () => this.deps.getWorkerClaimSnapshots(),
+                    // Durable ack persists straight through the session log; routed here (rather than
+                    // a new agent-session dep) because getSessionManager() is already a stable, generic
+                    // passthrough dep, so no other package needs to change for this to work.
+                    acknowledgeWorkerReview: (requestId) => acknowledgeWorkerClaimReview(this.deps.getSessionManager(), requestId),
+                });
+                this._baseToolDefinitions.set(delegateStatusToolDefinition.name, delegateStatusToolDefinition);
+            }
             // Registered but not default-active: probes spend tokens on the probed model, so
             // activation is an explicit choice (settings/profile/setActiveTools or /autonomy fitness).
-            const modelFitnessToolDefinition = createModelFitnessToolDefinition({
-                runProbe: (args) => this.deps.runModelFitness(args),
-            });
-            this._baseToolDefinitions.set(modelFitnessToolDefinition.name, modelFitnessToolDefinition);
-            if (settingsManager.getScoutSettings().enabled) {
+            if (toolAccess.allows("model_fitness")) {
+                const modelFitnessToolDefinition = createModelFitnessToolDefinition({
+                    runProbe: (args) => this.deps.runModelFitness(args),
+                });
+                this._baseToolDefinitions.set(modelFitnessToolDefinition.name, modelFitnessToolDefinition);
+            }
+            if (toolAccess.allows("context_scout") && settingsManager.getScoutSettings().enabled) {
                 const contextScoutToolDefinition = createContextScoutToolDefinition({
                     runScout: (input) => this._runContextScout(input.query, input.maxTurns, toolArtifactStore),
                 });
                 this._baseToolDefinitions.set(contextScoutToolDefinition.name, contextScoutToolDefinition);
             }
-            const runToolkitScriptToolDefinition = createRunToolkitScriptToolDefinition({
-                getScripts: () => this.deps.getSettingsManager().getToolkitScripts(),
-                execute: (script, scriptArgs) => executeToolkitScript({ script, scriptArgs, cwd: this.deps.getCwd() }),
-                artifactStore: toolArtifactStore,
-                // Reflex brain (fitness-gated local model): resolves ambiguous requests into a
-                // registry pick. Best-effort — absent/unfit brain keeps the shortlist behavior.
-                interpret: async (request, scripts) => {
-                    const model = this.deps.resolveCurationModelIfFit();
-                    if (!model)
-                        return undefined;
-                    const completion = await this.deps.runIsolatedCompletion({
-                        systemPrompt: REFLEX_INTERPRETER_SYSTEM_PROMPT,
-                        messages: [
-                            {
-                                role: "user",
-                                content: [{ type: "text", text: buildReflexUserPrompt(request, scripts) }],
-                                timestamp: Date.now(),
-                            },
-                        ],
-                        model,
-                        thinkingLevel: "off",
-                        maxTokens: 256,
-                        cacheRetention: "short",
-                        // Stable per-lane synthetic affinity key so repeat ambiguous-request
-                        // interpretations hit the same cache-warm backend.
-                        laneKind: "toolkit-brain",
-                    });
-                    if (completion.usage.cost.total > 0 || completion.usage.totalTokens > 0) {
-                        // `reportId` keyed on the ambiguous request text driving THIS interpretation —
-                        // stable across a retry of the same tool call, distinct across genuinely
-                        // different requests.
-                        const reportId = deriveSpawnedUsageReportId("toolkit-brain", this.deps.getSessionManager().getSessionId(), request);
-                        this.deps.addSpawnedUsage(completion.usage, { label: "toolkit-brain", reportId });
-                    }
-                    return parseReflexPlan(completion.text);
-                },
-            });
-            this._baseToolDefinitions.set(runToolkitScriptToolDefinition.name, runToolkitScriptToolDefinition);
+            if (toolAccess.allows("run_toolkit_script")) {
+                const runToolkitScriptToolDefinition = createRunToolkitScriptToolDefinition({
+                    getScripts: () => this.deps.getSettingsManager().getToolkitScripts(),
+                    execute: (script, scriptArgs) => executeToolkitScript({ script, scriptArgs, cwd: this.deps.getCwd() }),
+                    artifactStore: toolArtifactStore,
+                    // Reflex brain (fitness-gated local model): resolves ambiguous requests into a
+                    // registry pick. Best-effort — absent/unfit brain keeps the shortlist behavior.
+                    interpret: async (request, scripts) => {
+                        const model = this.deps.resolveCurationModelIfFit();
+                        if (!model)
+                            return undefined;
+                        const completion = await this.deps.runIsolatedCompletion({
+                            systemPrompt: REFLEX_INTERPRETER_SYSTEM_PROMPT,
+                            messages: [
+                                {
+                                    role: "user",
+                                    content: [{ type: "text", text: buildReflexUserPrompt(request, scripts) }],
+                                    timestamp: Date.now(),
+                                },
+                            ],
+                            model,
+                            thinkingLevel: "off",
+                            maxTokens: 256,
+                            cacheRetention: "short",
+                            // Stable per-lane synthetic affinity key so repeat ambiguous-request
+                            // interpretations hit the same cache-warm backend.
+                            laneKind: "toolkit-brain",
+                        });
+                        if (completion.usage.cost.total > 0 || completion.usage.totalTokens > 0) {
+                            // `reportId` keyed on the ambiguous request text driving THIS interpretation —
+                            // stable across a retry of the same tool call, distinct across genuinely
+                            // different requests.
+                            const reportId = deriveSpawnedUsageReportId("toolkit-brain", this.deps.getSessionManager().getSessionId(), request);
+                            this.deps.addSpawnedUsage(completion.usage, { label: "toolkit-brain", reportId });
+                        }
+                        return parseReflexPlan(completion.text);
+                    },
+                });
+                this._baseToolDefinitions.set(runToolkitScriptToolDefinition.name, runToolkitScriptToolDefinition);
+            }
             // Worktree-sync (opt-in): the closed-action lane workflow tool, plus -- for a session
             // launched lane-bound (PI_WORKTREE_LANE) -- the G8/G10 lane gate wrapped UNDER the
             // file-mutation tools (edit/write, plus cooperative bash only for interactive lanes), so a sync_required lane fails closed with the
             // exact recovery step rather than relying on prompt compliance. `worktreeSyncSettings` /
             // `worktreeSyncEngineDeps` are hoisted above (declared before the goal-tool registration)
             // so the goal->tmux lane-first dispatch dep and this tool share one settings/deps source.
-            if (worktreeSyncSettings.enabled) {
+            if (toolAccess.allows("worktree_sync") && worktreeSyncSettings?.enabled) {
                 const worktreeSyncToolDefinition = createWorktreeSyncToolDefinition({
                     engineDeps: worktreeSyncEngineDeps,
                     settings: () => this.deps.getSettingsManager().getWorktreeSyncSettings(),
@@ -636,7 +721,7 @@ export class RuntimeBuilder {
                 extensionsResult.runtime.flagValues.set(name, value);
             }
         }
-        const extensions = this.deps.filterExtensionsForRuntime(extensionsResult.extensions);
+        const extensions = this.deps.filterExtensionsForRuntime(extensionsResult.extensions, this._explicitLiveExtensionPaths);
         const runtimeExtensionPaths = new Set(extensions.map((extension) => extension.path));
         extensionsResult.runtime.pendingProviderRegistrations =
             extensionsResult.runtime.pendingProviderRegistrations.filter((registration) => runtimeExtensionPaths.has(registration.extensionPath));
@@ -753,6 +838,15 @@ export class RuntimeBuilder {
                 deferExtensionDispose: true,
                 skipSettingsReload: true,
             });
+            // A live-load call is an exact session-owned grant. Resource discovery deliberately cannot
+            // recreate it without a profile, so restore only those approved paths into the new runtime
+            // generation before binding it.
+            for (const extensionPath of this._explicitLiveExtensionPaths) {
+                if (this.deps.isExtensionPathAllowed(extensionPath, "explicit") &&
+                    !this.deps.getResourceLoader().getLoadedExtension(extensionPath)) {
+                    await this._importExtension(extensionPath);
+                }
+            }
             // Replace the previous extension-owned provider generation before binding the new one. The
             // bulk refresh also preserves API/OAuth streams for surviving non-extension providers.
             this.deps.getModelRegistry().unregisterProviders(previousExtensionProviderNames);
@@ -818,9 +912,23 @@ export class RuntimeBuilder {
      */
     async unloadExtensionLive(extensionPath) {
         this._assertReloadQuiescent("unload extension");
+        try {
+            await this._unloadExtensionLive(extensionPath, true, true);
+        }
+        catch (error) {
+            await this._recoverLiveExtensionFailure();
+            throw error;
+        }
+    }
+    async _unloadExtensionLive(extensionPath, revokeExplicitGrant, notify) {
         const ext = this.deps.getResourceLoader().getLoadedExtension(extensionPath);
+        const explicitGrantPath = ext?.path ?? extensionPath;
+        const hadExplicitGrant = this._explicitLiveExtensionPaths.has(explicitGrantPath);
+        if (revokeExplicitGrant) {
+            this._explicitLiveExtensionPaths.delete(explicitGrantPath);
+        }
         if (!ext) {
-            return; // Nothing to unload
+            return;
         }
         const previousRunner = this.deps.getExtensionRunner();
         try {
@@ -845,7 +953,7 @@ export class RuntimeBuilder {
                 flagValues: previousFlagValues,
                 includeAllExtensionTools: true,
             });
-            previousRunner.invalidate();
+            previousRunner.retire();
             const memorySnapshot = this.deps.createMemoryReloadSnapshot();
             this.deps.restoreMemoryReloadSnapshot({
                 ...memorySnapshot,
@@ -855,16 +963,13 @@ export class RuntimeBuilder {
             runtime.memoryProvidersByExtension.delete(ext.path);
             runtime.contextMemoryProvidersByExtension.delete(ext.path);
             await this.deps.initializeMemory();
-            // Notify extensions-changed listeners
-            this.deps.notifyExtensionsChanged();
+            if (notify) {
+                this.deps.notifyExtensionsChanged();
+            }
         }
         catch (error) {
-            // Fall back to full reload on error
-            try {
-                await this.reload();
-            }
-            catch {
-                // Suppress nested error; original error will be thrown below
+            if (revokeExplicitGrant && hadExplicitGrant) {
+                this._explicitLiveExtensionPaths.add(explicitGrantPath);
             }
             throw error;
         }
@@ -877,12 +982,26 @@ export class RuntimeBuilder {
      */
     async loadExtensionLive(extensionPath) {
         this._assertReloadQuiescent("load extension");
+        this._assertExtensionLoadAllowed(extensionPath, "explicit");
+        try {
+            await this._loadExtensionLive(extensionPath, "explicit", true);
+        }
+        catch (error) {
+            await this._recoverLiveExtensionFailure();
+            throw error;
+        }
+    }
+    async _loadExtensionLive(extensionPath, authority, notify) {
         const previousRunner = this.deps.getExtensionRunner();
+        let explicitGrantPath;
+        let hadExplicitGrant = false;
         try {
             // Load the extension with fresh import
-            const { extension, error } = await this.deps.getResourceLoader().loadSingleExtension(extensionPath);
-            if (error || !extension) {
-                throw new Error(error || `Failed to load extension: ${extensionPath}`);
+            const extension = await this._importExtension(extensionPath);
+            if (authority === "explicit") {
+                explicitGrantPath = extension.path;
+                hadExplicitGrant = this._explicitLiveExtensionPaths.has(explicitGrantPath);
+                this._explicitLiveExtensionPaths.add(explicitGrantPath);
             }
             // Rebuild runtime to aggregate tools/commands/handlers/providers
             const activeToolNames = this.deps.getRequestedActiveToolNames() ?? this.deps.getActiveToolNames();
@@ -897,20 +1016,38 @@ export class RuntimeBuilder {
             // Activate newly registered legacy/context providers immediately. Reinitialization also
             // refreshes provider tools and preserves all providers owned by existing extensions.
             await this.deps.initializeMemory();
-            // Notify extensions-changed listeners
-            this.deps.notifyExtensionsChanged();
+            previousRunner.retire();
+            if (notify) {
+                this.deps.notifyExtensionsChanged();
+            }
         }
         catch (error) {
-            // Fall back to full reload on error
-            try {
-                await this.reload();
-            }
-            catch {
-                // Suppress nested error; original error will be thrown below
+            if (explicitGrantPath && !hadExplicitGrant) {
+                this._explicitLiveExtensionPaths.delete(explicitGrantPath);
             }
             throw error;
         }
     }
+    async _importExtension(extensionPath) {
+        const { extension, error } = await this.deps.getResourceLoader().loadSingleExtension(extensionPath);
+        if (error || !extension) {
+            throw new Error(error || `Failed to load extension: ${extensionPath}`);
+        }
+        return extension;
+    }
+    _assertExtensionLoadAllowed(extensionPath, authority) {
+        if (!this.deps.isExtensionPathAllowed(extensionPath, authority)) {
+            throw new Error(`Cannot load extension outside the active resource profile: ${extensionPath}`);
+        }
+    }
+    async _recoverLiveExtensionFailure() {
+        try {
+            await this.reload();
+        }
+        catch {
+            // Preserve the original live-operation error; recovery is best effort.
+        }
+    }
     /**
      * Reconcile loaded extensions with the active profile.
      * Loads extensions that should be enabled but aren't, and unloads extensions that shouldn't be.
@@ -921,66 +1058,41 @@ export class RuntimeBuilder {
         try {
             // Get all discoverable extension paths
             const allDiscoverablePaths = await this.deps.getResourceLoader().getDiscoverableExtensionPaths();
-            // Get the target enabled set based on profile filters
-            const targetEnabledSet = new Set();
-            for (const path of allDiscoverablePaths) {
-                if (this.deps.getSettingsManager().isResourceAllowedByProfile("extensions", path)) {
-                    targetEnabledSet.add(path);
-                }
-            }
-            // Get currently loaded set
             const loadedExtensions = this.deps.getResourceLoader().getExtensions().extensions;
-            const loadedSet = new Set();
-            for (const ext of loadedExtensions) {
-                loadedSet.add(ext.path);
-            }
-            // Collect unloads and loads
-            const toUnload = [];
-            const toLoad = [];
-            for (const path of loadedSet) {
-                if (!targetEnabledSet.has(path)) {
-                    toUnload.push(path);
-                }
+            const targetAuthorities = new Map();
+            for (const extension of this.deps.filterExtensionsForRuntime(loadedExtensions, this._explicitLiveExtensionPaths)) {
+                targetAuthorities.set(extension.path, "loaded");
             }
-            for (const path of targetEnabledSet) {
-                if (!loadedSet.has(path)) {
-                    toLoad.push(path);
+            for (const path of this._explicitLiveExtensionPaths) {
+                if (this.deps.isExtensionPathAllowed(path, "explicit")) {
+                    targetAuthorities.set(path, "explicit");
                 }
             }
-            // Apply unloads first, then loads, to minimize churn
-            // Collect errors but continue through all operations
-            const errors = [];
-            for (const path of toUnload) {
-                try {
-                    await this.unloadExtensionLive(path);
-                }
-                catch (error) {
-                    errors.push(error instanceof Error ? error : new Error(String(error)));
+            for (const path of allDiscoverablePaths) {
+                if (this.deps.isExtensionPathAllowed(path, "profile") && !targetAuthorities.has(path)) {
+                    targetAuthorities.set(path, "profile");
                 }
             }
-            for (const path of toLoad) {
-                try {
-                    await this.loadExtensionLive(path);
-                }
-                catch (error) {
-                    errors.push(error instanceof Error ? error : new Error(String(error)));
-                }
+            // Apply unloads first, then loads. A failed mutation stops the generation immediately; the
+            // outer recovery reload restores one coherent runtime instead of compounding partial changes.
+            for (const extension of [...loadedExtensions]) {
+                if (targetAuthorities.has(extension.path) || targetAuthorities.has(extension.resolvedPath))
+                    continue;
+                this._assertReloadQuiescent("reconcile extensions");
+                await this._unloadExtensionLive(extension.path, false, false);
             }
-            // If any errors occurred, throw the first one (already fell back to full reload in load/unload)
-            if (errors.length > 0) {
-                throw errors[0];
+            for (const [path, authority] of targetAuthorities) {
+                if (authority === "loaded" || this.deps.getResourceLoader().getLoadedExtension(path))
+                    continue;
+                this._assertReloadQuiescent("reconcile extensions");
+                this._assertExtensionLoadAllowed(path, authority);
+                await this._loadExtensionLive(path, authority, false);
             }
             // Single notification at the end
             this.deps.notifyExtensionsChanged();
         }
         catch (error) {
-            // Fall back to full reload on error
-            try {
-                await this.reload();
-            }
-            catch {
-                // Suppress nested error; original error will be thrown below
-            }
+            await this._recoverLiveExtensionFailure();
             throw error;
         }
     }