@compilr-dev/sdk 0.25.0 → 0.25.1

package/dist/skills/resolver.d.ts

@@ -62,10 +62,11 @@ export declare function resolveSkillsForAgent(skills: CustomSkill[], context: Sk
  * than once. Every judgement lives here: which fields of the agent matter, and what an absent
  * allowlist means.
  *
- * ⚠️ `enabledSkills: []` IS NOT `undefined`, exactly as with MCP grants. `undefined` is "never
- * asked" — every agent created before skills were choosable, which must keep reaching everything
- * eligible. `[]` is "asked, and granted nothing". Collapsing them either strips capability from
- * working agents or hands new ones the lot.
+ * ⚠️ `enabledSkills` DOES NOT FOLLOW THE MCP GRANT CONTRACT, and must not be made to. There,
+ * `[]` means "granted nothing" because the field was new. Here both `undefined` and `[]` mean
+ * "unrestricted": the field predates choosable skills, `createCustomAgentDefinition` normalises
+ * `undefined` to `[]`, and every UI that collects it says empty means all. Only a NON-EMPTY list
+ * filters.
  *
  * @param pool  every skill installed for this machine/project, unfiltered
  * @param agent the agent being built — role, id and its allowlist come from here

package/dist/skills/resolver.js

@@ -46,7 +46,21 @@ export function resolveLayeredSkills(layers) {
  */
 export function resolveSkillsForAgent(skills, context) {
     const toolSet = context.toolNames instanceof Set ? context.toolNames : new Set(context.toolNames ?? []);
-    const allowlist = context.enabledSkills ? new Set(context.enabledSkills) : null;
+    /*
+      ⚠️ AN EMPTY ALLOWLIST MEANS "UNRESTRICTED", NOT "NOTHING" — the opposite of the MCP grant
+      contract, and deliberately so. `enabledSkills` predates model-choosable skills and already had
+      a meaning, stated in three places: `CustomAgentDefinition.enabledSkills` is documented "Empty =
+      all skills, non-empty = filtered", `createCustomAgentDefinition` normalises `undefined` to `[]`
+      with the same comment, and Desktop's spawn dialog tells the user "Empty = all skills enabled".
+  
+      0.25.0 copied the MCP reading (`[]` = granted nothing) onto this field and inverted it. Because
+      the definition normalises to `[]`, EVERY custom agent ever created carries one — so every one
+      of them silently got no skills at all, having been told empty meant everything.
+  
+      MCP grants could afford the stricter reading because they were new and nothing had a prior
+      meaning. This field is not new. Honour what the UI has been promising.
+    */
+    const allowlist = context.enabledSkills?.length ? new Set(context.enabledSkills) : null;
     return skills.filter((skill) => {
         if (skill.enabled === false)
             return false;
@@ -87,10 +101,11 @@ export function resolveSkillsForAgent(skills, context) {
  * than once. Every judgement lives here: which fields of the agent matter, and what an absent
  * allowlist means.
  *
- * ⚠️ `enabledSkills: []` IS NOT `undefined`, exactly as with MCP grants. `undefined` is "never
- * asked" — every agent created before skills were choosable, which must keep reaching everything
- * eligible. `[]` is "asked, and granted nothing". Collapsing them either strips capability from
- * working agents or hands new ones the lot.
+ * ⚠️ `enabledSkills` DOES NOT FOLLOW THE MCP GRANT CONTRACT, and must not be made to. There,
+ * `[]` means "granted nothing" because the field was new. Here both `undefined` and `[]` mean
+ * "unrestricted": the field predates choosable skills, `createCustomAgentDefinition` normalises
+ * `undefined` to `[]`, and every UI that collects it says empty means all. Only a NON-EMPTY list
+ * filters.
  *
  * @param pool  every skill installed for this machine/project, unfiltered
  * @param agent the agent being built — role, id and its allowlist come from here

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@compilr-dev/sdk",
-  "version": "0.25.0",
+  "version": "0.25.1",
   "description": "Universal agent runtime for building AI-powered applications",
   "type": "module",
   "main": "dist/index.js",