@edgehero/pi-dispatch 1.10.2 → 2.0.0

package/src/triggers.mjs

@@ -25,11 +25,14 @@
 
 import { BACKEND_NAMES, backendFor } from "./backends.mjs";
 import { EGRESS_ENV_VARS, WORKER_ONLY_SECRET_VARS, configError } from "./config.mjs";
+import { imageRefProblem } from "./image-ref.mjs";
 // SKILL_NAME_RE is the single-sourced skill charset (flow-gate exports it for exactly this reason:
 // materialize.mjs and the admin already import it, and a keep-in-sync copy would drift where a
 // traversal guard cannot). flow-gate's module body is import-inert, so this keeps parseTriggers pure.
 import { SKILL_NAME_RE } from "./flow-gate.mjs";
 import { FORGE_HOST_VARS, FORGE_KINDS, MINTED_TOKEN_VARS, RUN_KINDS, forgeSpec, isForgeKind } from "./forges.mjs";
+import { findDuplicateKey } from "./json-duplicates.mjs";
+import { PROVIDER_STEERING_VARS } from "./provider-steering.mjs";
 import { CONTAINER_ENV_NAMES } from "./reserved-env.mjs";
 // The wait grammar's two shared halves (issue #230). `afterInstantMs` is imported rather than restated so
 // the loader and the pickup gate cannot disagree about what a legal instant is: a second spelling here is
@@ -37,7 +40,8 @@ import { CONTAINER_ENV_NAMES } from "./reserved-env.mjs";
 // fs-free, so importing it keeps parseTriggers pure.
 import { WAIT_CONDITION_KEYS, WAIT_CONDITION_MAX, afterInstantMs } from "./wait-for.mjs";
 
-const ON_TYPES = new Set(["cron", "label", "comment", "pull_request", "issue"]);
+// EXPORTED for the same reason as PR_ACTIONS: the admin re-states this vocabulary to a MODEL.
+export const ON_TYPES = new Set(["cron", "label", "comment", "pull_request", "issue"]);
 
 /**
  * The `on.type` a DISARMED one-shot normalizes to (issue #231). Producible only by this validator:
@@ -82,7 +86,9 @@ export { FORGE_KINDS };
  * have made one forge's review a type and the other's an action. The gate on it is the REVIEWER's
  * `author_association`, never the PR author's -- see filter.mjs and CONST-TRIGGER-AUTHOR-GATE.
  */
-const PR_ACTIONS = {
+// EXPORTED for the receiver's four route gates, which each carry this vocabulary MINUS their own named
+// exclusions and must be able to prove that relation rather than restate it (issue #286's sweep).
+export const PR_ACTIONS = {
 	github: new Set(["labeled", "opened", "synchronize", "reopened", "review_submitted", "closed"]),
 	// GitLab's `approved` is its review gate (a member approved the MR). It is NOT github's
 	// `review_submitted` renamed: `approved` is one verdict, `review_submitted` is every verdict, which is
@@ -132,7 +138,10 @@ export const PR_CLOSE_ACTIONS = { github: "closed", gitlab: "close", forgejo: "c
  * guess at. Not yet covered, not impossible -- validateResumeFlag's distinction, kept for the same
  * reason.
  */
-const ISSUE_ACTIONS = {
+// EXPORTED beside PR_ACTIONS: the admin's ISSUE_CLOSE_WORD is derived from THIS table and not from
+// PR_CLOSE_ACTIONS. The two hold identical values today and are separately justified, so deriving the
+// issue word from the pull-request one would be a coincidence dressed as a derivation.
+export const ISSUE_ACTIONS = {
 	github: new Set(["closed"]),
 	gitlab: new Set(["close"]),
 	forgejo: new Set(["closed"]),
@@ -151,11 +160,25 @@ const ISSUE_ACTIONS = {
  * `dismissed` is absent because it is an ACTION on the `pull_request_review` event, not a state a
  * submitted review carries.
  */
-const REVIEW_STATES = new Set(["approved", "changes_requested", "commented"]);
+// EXPORTED so the admin's tool description can state the vocabulary rather than retype it.
+export const REVIEW_STATES = new Set(["approved", "changes_requested", "commented"]);
 
 /** The one action `on.reviewState` can narrow. Spelled once, read by the validator and named in its error. */
 const REVIEW_ACTION = "review_submitted";
 
+/**
+ * The pi tool names a trigger may exclude (issue #291) -- the built-in set of the PINNED pi, 0.80.7.
+ * Hand-written because this validator is pure and pi-free (the worker does not depend on the agent
+ * package), and therefore BOLTED twice to the artifact it restates: `worker/test/exclude-tools.pinned.test.mjs`
+ * and `image/runner/test/pinned-api.test.mjs` both derive the set from the pinned package and fail with a
+ * grow-these-together message when a pin bump moves it. Extension and custom tool names are deliberately
+ * NOT here: they register at container start (a staged package, a serviced repo's own `.pi/extensions`),
+ * so the loader cannot know them, and admitting free strings would re-open the silent no-op this field's
+ * validation exists to close -- pi ignores unknown names in `excludeTools` without a diagnostic.
+ */
+// EXPORTED for the two pinned-set bolts and for the admin, which states the vocabulary to an operator.
+export const EXCLUDABLE_TOOL_NAMES = new Set(["read", "bash", "edit", "write", "grep", "find", "ls"]);
+
 // A cron id flows into BullMQ's deterministic `repeat:<id>:<nextMillis>` jobId, so a `:` corrupts that
 // parse; the charset also excludes `:` and the dedicated check names the reason.
 const ID_CHARSET = /^[A-Za-z0-9._-]+$/;
@@ -193,8 +216,8 @@ const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
  * The env variable names a trigger may NOT bind, and why each set is here.
  *
  * These are the STATICALLY KNOWABLE half. `parseTriggers` is pure, fs-free and env-free, so it cannot see
- * the resolved provider's credential variable names (they come from `findEnvKeys(provider, hostEnv)`) or
- * the deployment's `PI_FORWARD_ENV` list. Those two are refused PRE-SPEND in the processor, where both are
+ * the resolved provider's credential variable names (they depend on which provider the job runs on, which
+ * is settings state) or the deployment's `PI_FORWARD_ENV` list. Those two are refused PRE-SPEND in the processor, where both are
  * in hand -- the same load-time / deployment-state split `run.resume` already makes against
  * `PI_SESSIONS_DIR`. Refusing here what can be answered here keeps the file's own mistakes in the file's
  * own error.
@@ -202,7 +225,7 @@ const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
  * Every set is IMPORTED, never retyped, which is the rule `sandbox.test.mjs` keeps for the same reason: a
  * forge added to the table later must not need a second edit here to stay covered.
  */
-const RESERVED_ENV_NAMES = new Set([...MINTED_TOKEN_VARS, ...FORGE_HOST_VARS, ...WORKER_ONLY_SECRET_VARS, ...EGRESS_ENV_VARS, ...CONTAINER_ENV_NAMES]);
+const RESERVED_ENV_NAMES = new Set([...MINTED_TOKEN_VARS, ...FORGE_HOST_VARS, ...WORKER_ONLY_SECRET_VARS, ...EGRESS_ENV_VARS, ...CONTAINER_ENV_NAMES, ...PROVIDER_STEERING_VARS]);
 
 function isNonEmptyString(value) {
 	return typeof value === "string" && value.trim() !== "";
@@ -221,6 +244,23 @@ export function parseTriggers(text, path) {
 		throw configError(`triggers file is not valid JSON: ${path} (${error.message})`);
 	}
 
+	// AFTER the parse, never before (issue #313). The scanner's whole safety argument is that it only ever
+	// sees text `JSON.parse` has already accepted, so it never has to decide whether malformed input is
+	// malformed; and this order keeps "not valid JSON" the first thing an operator is told, unchanged.
+	//
+	// REFUSED, not repaired, and the whole file rather than the entry. `JSON.parse` keeps the LAST value
+	// for a duplicated key, so the reviewed file and the running file differ with nothing to say so, and
+	// the reach is the whole schema rather than one field. This file's posture everywhere else is that
+	// something which does not say one thing is not something to run half of, and the closest precedent is
+	// its own refusal of an unknown key inside a CONDITION: elsewhere a dropped key is a field that does
+	// nothing, there and here it is a term of a gate that does nothing while the job still runs.
+	const duplicate = findDuplicateKey(text);
+	if (duplicate) {
+		throw configError(
+			`triggers file has a duplicate key ${JSON.stringify(duplicate.key)} at ${duplicate.at}: JSON keeps the LAST value, so the file that was reviewed and the file that runs are not the same file: ${path}`,
+		);
+	}
+
 	const entries = parsed?.triggers;
 	if (!Array.isArray(entries)) {
 		throw configError(`triggers file must have a "triggers" array: ${path}`);
@@ -355,6 +395,9 @@ function normalizeCron(on, run, index, path, state) {
 	// Called for its refusal only: the returned `run` below deliberately grows no `waitFor` key, exactly as
 	// it grows no `replicas` one, because a cron entry can never carry either (issue #230).
 	validateWaitFor(on, run, `cron trigger "${id}"`, path, { onType: "cron" });
+	// A cron job's session narrows like any other: the field selects what the container's agent can do,
+	// which is orthogonal to what triggered it (issue #291).
+	const excludeTools = validateExcludeTools(on, run, `cron trigger "${id}"`, path);
 
 	// provider/model/maxTurns stay absent when omitted so the value resolves at job start against the
 	// settings overlay/env, not a default frozen here (INT-CONFIG-OVERLAY-CONTRACT). github/packages/image stay
@@ -363,7 +406,7 @@ function normalizeCron(on, run, index, path, state) {
 	// freeze today's default into every stored repeatable.
 	return {
 		on: { type: "cron", id, pattern },
-		run: { kind: "local", folder: run.folder, flow: run.flow, task: run.task, provider: run.provider, model: run.model, maxTurns: run.maxTurns, github: run.github, packages, image, resume, ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(backend !== undefined && { backend }) },
+		run: { kind: "local", folder: run.folder, flow: run.flow, task: run.task, provider: run.provider, model: run.model, maxTurns: run.maxTurns, github: run.github, packages, image, resume, ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }) },
 	};
 }
 
@@ -481,15 +524,18 @@ function validateResumeFlag(run, at, path) {
 function validateImageRef(run, at, path) {
 	const image = run.image;
 	if (image === undefined) return undefined;
-	if (typeof image !== "string" || image.trim() === "") {
+	// The shared rule (`image-ref.mjs`, issue #471), so PI_JOB_IMAGE at boot and doctor refuse exactly what this does.
+	const problem = imageRefProblem(image);
+	if (problem?.code === "blank") {
 		throw configError(`${at}: run.image must be a non-empty string when present: ${path}`);
 	}
-	if (image !== image.trim()) {
+	if (problem?.code === "padded") {
 		throw configError(`${at}: run.image must not have leading or trailing whitespace (got ${JSON.stringify(image)}): ${path}`);
 	}
-	if (image.startsWith("-")) {
+	if (problem?.code === "dash") {
 		throw configError(`${at}: run.image must not start with "-" -- it is passed as the image positional in the docker argv, where a leading dash parses as a flag (got ${JSON.stringify(image)}): ${path}`);
 	}
+	if (problem) throw configError(`${at}: run.image ${problem.reason} (got ${JSON.stringify(image)}): ${path}`);
 	return image;
 }
 
@@ -938,8 +984,27 @@ function validateSecrets(run, at, path) {
 		if (!ENV_NAME.test(name)) {
 			throw configError(`${at}: run.secrets key ${JSON.stringify(name)} is not an environment variable name (letters, digits and underscore, not starting with a digit): ${path}`);
 		}
+		// `__proto__` passes ENV_NAME and is in no reserved set, and it is the one name that cannot survive the
+		// journey: `JSON.parse` gives it as an own property and the spread below preserves it, but every later
+		// hop assigns with `=` into a plain object (`secrets[name]` in secrets.mjs, `env[name]` in
+		// env-allowlist.mjs), where it hits `Object.prototype`'s setter and does nothing at all. The resolver
+		// still runs, so the operator's vault is read for a value the container never receives, and the job
+		// proceeds to a clean exit with the variable unset: the silent no-op this whole feature refuses
+		// everywhere else. Refused here rather than repaired downstream, because a name that cannot be carried
+		// is a fact about the file, and the file is the reviewed artifact.
+		if (name === "__proto__") {
+			throw configError(`${at}: run.secrets key "__proto__" cannot be carried into a container -- it is swallowed by the prototype setter on every object between here and the job, so the resolver would run and the variable would still be unset: ${path}`);
+		}
 		if (RESERVED_ENV_NAMES.has(name)) {
-			throw configError(`${at}: run.secrets key ${JSON.stringify(name)} is a variable the worker sets itself -- the job container would receive the worker's value, not this trigger's, and the trigger would look like it worked: ${path}`);
+			// TWO reasons a name can be in here, opposite in direction, and the message asserts NEITHER,
+			// because asserting the wrong one is worse than asserting neither: that is the mistake issue
+			// #309 corrected in the pre-spend gate's message, and #314 widened the set far enough that a
+			// disjunction would be false in both branches for some members. The worker writes some of
+			// these; pi or a provider SDK reads others; a few belong to a provider this deployment does not
+			// even use, and a few (`OPENAI_LOG`, `PI_CACHE_RETENTION`) steer nothing dangerous at all and
+			// are reserved only because the set is a derivation rather than a judgement. The one thing
+			// true of every member is that the runtime already owns the name.
+			throw configError(`${at}: run.secrets key ${JSON.stringify(name)} is reserved: this deployment's own runtime reads or writes it, so a value bound here would not do what the trigger intends: ${path}`);
 		}
 		const reference = secrets[name];
 		if (!isNonEmptyString(reference)) {
@@ -1030,9 +1095,10 @@ export function refusesLocalWorkspace(entry, localWorkspace) {
  *
  * A NEAR-MISS SPELLING IS REFUSED, which puts this in `waitFor`'s class rather than `run.imgae`'s. A
  * misspelled image gives you the default image and a job that ran; a misspelled `backend` gives you the
- * DEFAULT VENUE and a job that ran -- byte-identical in the record, the panel and the log to one that
- * correctly named a venue, while the operator reads the file as though it chose. That is the destructive
- * absence `validateWaitFor` refuses near-misses for, one field over.
+ * DEFAULT VENUE and a job that ran, while the operator reads the file as though it chose. Since #277 the run
+ * record and RUN_DETAIL name the venue the job fell back to, but only AFTER it ran and spent: a record is an
+ * audit, not a guard. That is the destructive absence `validateWaitFor` refuses near-misses for, one field
+ * over.
  */
 function validateBackend(on, run, at, path, { localWorkspace }) {
 	// The near-miss sweep, exactly `validateWaitFor`'s: on `run` the exact spelling is the field, on `on`
@@ -1103,6 +1169,93 @@ function validateBackend(on, run, at, path, { localWorkspace }) {
 	return backend;
 }
 
+/**
+ * `run.excludeTools` -- pi tool names this trigger's session must NOT have (issue #291).
+ *
+ * The first field here that changes what the agent CAN DO inside the container rather than what the
+ * container holds: the runner passes it to `createAgentSession`, which filters the tool registry itself,
+ * so a "read-only" trigger stops being prompt text. NARROWING ONLY, by decision: the allowlist form
+ * (`run.tools`) inverts the question to "which tools exist", which is the pinned package's answer and
+ * drifts with every pin bump -- a bump that adds a tool would silently grant it to every allowlisted
+ * trigger, while naming what to take away cannot widen on a bump.
+ *
+ * MEMBERSHIP IS VALIDATED against `EXCLUDABLE_TOOL_NAMES` because pi ignores unknown names in
+ * `excludeTools` silently (verified at the pin: the set is only ever consulted by a filter), which puts
+ * a misspelled exclusion in `run.backend`'s destructive-absence class -- the job runs WITH the tool
+ * while the file reads as though it was off. The near-miss sweep covers the KEY for the same reason.
+ * No charset check: membership subsumes it, and no known name carries the comma the container env
+ * encoding uses. No cap: membership plus the duplicate refusal bound any accepted array at the set's
+ * own size. Excluding every builtin is legal -- extension and custom tools still load, which is a
+ * documented bound of the field, not a gap.
+ */
+function validateExcludeTools(on, run, at, path) {
+	// The near-miss sweep, validateBackend's shape (its comment carries the homoglyph rationale): on
+	// `run` the exact spelling is the field, on `on` every spelling is wrong including the correct one,
+	// because what the session can do is a property of the run.
+	for (const [label, source, exactIsLegal] of [
+		["run", run, true],
+		["on", on, false],
+	]) {
+		for (const key of Object.keys(source ?? {})) {
+			if (exactIsLegal && key === "excludeTools") continue;
+			// Three targets. The first catches every case and separator variant (exclude_tools,
+			// exclude-tools, EXCLUDETOOLS). The SINGULAR is the likeliest miss of all: an operator
+			// removing one tool writes `excludeTool` the way English does, and unlike `backend` there is
+			// no env-var mnemonic anchoring the right form. The past participle is how the field reads
+			// back in prose ("the excluded tools"), one grammatical step with no other plausible meaning.
+			// Deliberately NOT a synonym hunt (denyTools, toolsOff): that is the general unknown-key
+			// sweep this file's forward-compatibility posture rejects.
+			const normalized = key.replace(/[^a-z0-9]/gi, "").toLowerCase();
+			const targets = ["excludetools", "excludetool", "excludedtools"];
+			const isSubsequence = (needle, hay) => {
+				let i = 0;
+				for (const ch of hay) if (i < needle.length && needle[i] === ch) i++;
+				return i === needle.length;
+			};
+			const suspicious = /^[\x20-\x7E]*$/.test(key)
+				? targets.includes(normalized)
+				: normalized.length >= 4 && targets.some((t) => isSubsequence(normalized, t));
+			if (!suspicious) continue;
+			throw configError(`${at}: ${label}.${key} is not a field -- did you mean run.excludeTools? An exclusion the loader drops runs the job WITH the tool while the file reads as though it was off, so a near miss is refused rather than dropped: ${path}`);
+		}
+	}
+
+	// pi's OWN option names are refused by name, before the absent-field return, so a file carrying only
+	// the wrong field still hears why. `tools` because the allowlist inversion above is a decision, not
+	// an oversight; `noTools` because it is the other tool switch on the same options object and
+	// "notools" shares no subsequence with "excludetools", so the sweep above can never catch it -- and
+	// a dropped tool switch is the exact destructive absence this validator refuses.
+	if ("tools" in (run ?? {})) {
+		throw configError(`${at}: run.tools is not a field -- pi-dispatch narrows only. An allowlist inverts the question to "which tools exist", which is the pinned pi's answer, not this file's: a pin bump that adds a tool would silently grant it to every allowlisted trigger. Name what to take away in run.excludeTools: ${path}`);
+	}
+	if ("noTools" in (run ?? {})) {
+		throw configError(`${at}: run.noTools is not a field -- it is pi's own session option, and here it would be dropped silently, which for a tool switch is the destructive absence this validator refuses; spell the removal in run.excludeTools: ${path}`);
+	}
+
+	const excludeTools = run?.excludeTools;
+	if (excludeTools === undefined) return undefined;
+
+	if (!Array.isArray(excludeTools) || excludeTools.length === 0) {
+		throw configError(`${at}: run.excludeTools must be a non-empty array of tool names when present (got ${JSON.stringify(excludeTools)}) -- an empty exclusion is a field that does nothing, and accepted-and-ignored is how an operator comes to trust one that does: ${path}`);
+	}
+	const seen = new Set();
+	for (let i = 0; i < excludeTools.length; i++) {
+		const name = excludeTools[i];
+		if (!isNonEmptyString(name)) {
+			throw configError(`${at}: run.excludeTools[${i}] must be a non-empty string naming a pi tool (got ${JSON.stringify(name)}): ${path}`);
+		}
+		if (!EXCLUDABLE_TOOL_NAMES.has(name)) {
+			throw configError(`${at}: run.excludeTools[${i}] ${JSON.stringify(name)} is not a tool the pinned pi knows (known: ${[...EXCLUDABLE_TOOL_NAMES].join(", ")}) -- pi ignores unknown names silently, so a misspelled exclusion would exclude nothing while the file reads as though it did: ${path}`);
+		}
+		if (seen.has(name)) {
+			throw configError(`${at}: run.excludeTools names ${JSON.stringify(name)} twice -- the entries are a removal set, so the second can never change the answer: ${path}`);
+		}
+		seen.add(name);
+	}
+	// A freshly built array, validateWaitFor's rule: nothing unvalidated rides through.
+	return [...excludeTools];
+}
+
 /**
  * `run.waitFor` -- the conditions that must all clear before this trigger's job starts (issue #230).
  *
@@ -1260,9 +1413,10 @@ function normalizeLabel(on, run, index, path) {
 	const secretsProfile = validateSecretsProfile(run, at, path);
 	const backend = validateBackend(on, run, at, path, { localWorkspace: false });
 	const waitFor = validateWaitFor(on, run, at, path, { onType: on.type });
+	const excludeTools = validateExcludeTools(on, run, at, path);
 	return {
 		on: { type: "label", any: predicate.any, all: predicate.all, none: predicate.none },
-		run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(instructions !== undefined && { instructions }), ...(repository !== undefined && { repository }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(waitFor !== undefined && { waitFor }), ...(backend !== undefined && { backend }) },
+		run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(instructions !== undefined && { instructions }), ...(repository !== undefined && { repository }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(waitFor !== undefined && { waitFor }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }) },
 	};
 }
 
@@ -1300,9 +1454,10 @@ function normalizeComment(on, run, index, path, state) {
 	const secretsProfile = validateSecretsProfile(run, at, path);
 	const backend = validateBackend(on, run, at, path, { localWorkspace: false });
 	const waitFor = validateWaitFor(on, run, at, path, { onType: on.type });
+	const excludeTools = validateExcludeTools(on, run, at, path);
 	return {
 		on: { type: "comment", phrase: on.phrase },
-		run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(instructions !== undefined && { instructions }), ...(repository !== undefined && { repository }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(waitFor !== undefined && { waitFor }), ...(backend !== undefined && { backend }) },
+		run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(instructions !== undefined && { instructions }), ...(repository !== undefined && { repository }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(waitFor !== undefined && { waitFor }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }) },
 	};
 }
 
@@ -1367,6 +1522,7 @@ function normalizeIssue(on, run, index, path) {
 	const secretsProfile = validateSecretsProfile(run, at, path);
 	const backend = validateBackend(on, run, at, path, { localWorkspace: false });
 	const waitFor = validateWaitFor(on, run, at, path, { onType: on.type });
+	const excludeTools = validateExcludeTools(on, run, at, path);
 	return {
 		on: {
 			type: "issue",
@@ -1376,7 +1532,7 @@ function normalizeIssue(on, run, index, path) {
 			...(number !== undefined && { number }),
 			...(once !== undefined && { once }),
 		},
-		run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(instructions !== undefined && { instructions }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(waitFor !== undefined && { waitFor }), ...(backend !== undefined && { backend }) },
+		run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(instructions !== undefined && { instructions }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(waitFor !== undefined && { waitFor }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }) },
 	};
 }
 
@@ -1452,6 +1608,7 @@ function normalizePullRequest(on, run, index, path) {
 	const secretsProfile = validateSecretsProfile(run, at, path);
 	const backend = validateBackend(on, run, at, path, { localWorkspace: false });
 	const waitFor = validateWaitFor(on, run, at, path, { onType: on.type });
+	const excludeTools = validateExcludeTools(on, run, at, path);
 	return {
 		on: {
 			type: "pull_request",
@@ -1466,7 +1623,7 @@ function normalizePullRequest(on, run, index, path) {
 			...(number !== undefined && { number }),
 			...(once !== undefined && { once }),
 		},
-		run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(instructions !== undefined && { instructions }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(waitFor !== undefined && { waitFor }), ...(backend !== undefined && { backend }) },
+		run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...(command !== undefined && { command }), ...(skillsDir !== undefined && { skillsDir }), ...(instructions !== undefined && { instructions }), ...(secrets !== undefined && { secrets }), ...(secretsProfile !== undefined && { secretsProfile }), ...(waitFor !== undefined && { waitFor }), ...(backend !== undefined && { backend }), ...(excludeTools !== undefined && { excludeTools }) },
 	};
 }