@fased/fased 0.1.61 → 0.1.64

package/dist/agents/docs-path.js

@@ -1,5 +1,5 @@
 import { resolveFasedAgentPackageRoot } from "../infra/fased-root.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/agents/docs-path.ts
@@ -7,7 +7,7 @@ async function resolveFasedAgentDocsPath(params) {
 	const workspaceDir = params.workspaceDir?.trim();
 	if (workspaceDir) {
 		const workspaceDocs = path.join(workspaceDir, "docs");
-		if (fs.existsSync(workspaceDocs)) {
+		if (syncFs.existsSync(workspaceDocs)) {
 			return workspaceDocs;
 		}
 	}
@@ -20,7 +20,7 @@ async function resolveFasedAgentDocsPath(params) {
 		return null;
 	}
 	const packageDocs = path.join(packageRoot, "docs");
-	return fs.existsSync(packageDocs) ? packageDocs : null;
+	return syncFs.existsSync(packageDocs) ? packageDocs : null;
 }
 
 //#endregion

package/dist/agents/embedded-pi-mcp.js

@@ -1,6 +1,6 @@
 import { STATE_DIR } from "../config/paths.js";
 import { isRecord, resolveUserPath } from "../utils.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/agents/embedded-pi-mcp.ts
@@ -66,10 +66,10 @@ function readBundleMcpFile(params) {
 	if (relative.startsWith("..") || path.isAbsolute(relative)) {
 		return {};
 	}
-	if (!fs.existsSync(filePath)) {
+	if (!syncFs.existsSync(filePath)) {
 		return {};
 	}
-	const raw = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+	const raw = JSON.parse(syncFs.readFileSync(filePath, "utf-8"));
 	const servers = extractMcpServerMap(raw);
 	const baseDir = path.dirname(filePath);
 	return Object.fromEntries(Object.entries(servers).map(([serverName, server]) => [serverName, absolutizeBundleMcpServer({
@@ -99,7 +99,7 @@ function loadEnabledBundleMcpConfig(params) {
 			cfg: params.cfg,
 			pluginId
 		})) {
-			if (!fs.existsSync(rootDir)) {
+			if (!syncFs.existsSync(rootDir)) {
 				continue;
 			}
 			for (const fileName of BUNDLE_MCP_FILENAMES) {

package/dist/agents/identity-avatar.js

@@ -3,7 +3,7 @@ import { resolveAgentWorkspaceDir } from "./agent-scope.js";
 import { AVATAR_MAX_BYTES, isAvatarDataUrl, isAvatarHttpUrl, isPathWithinRoot, isSupportedLocalAvatarExtension } from "../shared/avatar-policy.js";
 import { resolveAgentIdentity } from "./identity.js";
 import { loadAgentIdentityFromWorkspace } from "./identity-file.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/agents/identity-avatar.ts
@@ -28,7 +28,7 @@ function resolveAvatarSource(cfg, agentId, opts) {
 }
 function resolveExistingPath(value) {
 	try {
-		return fs.realpathSync(value);
+		return syncFs.realpathSync(value);
 	} catch {
 		return path.resolve(value);
 	}
@@ -51,7 +51,7 @@ function resolveLocalAvatarPath(params) {
 		};
 	}
 	try {
-		const stat = fs.statSync(realPath);
+		const stat = syncFs.statSync(realPath);
 		if (!stat.isFile()) {
 			return {
 				ok: false,

package/dist/agents/identity-file.js

@@ -1,5 +1,5 @@
 import { DEFAULT_IDENTITY_FILENAME } from "./workspace.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/agents/identity-file.ts
@@ -67,7 +67,7 @@ function identityHasValues(identity) {
 }
 function loadIdentityFromFile(identityPath) {
 	try {
-		const content = fs.readFileSync(identityPath, "utf-8");
+		const content = syncFs.readFileSync(identityPath, "utf-8");
 		const parsed = parseIdentityMarkdown(content);
 		if (!identityHasValues(parsed)) {
 			return null;

package/dist/agents/memory-search.js

@@ -131,6 +131,7 @@ function mergeConfig(defaults, overrides, agentId) {
 		baseUrl: overrideRemote?.baseUrl ?? defaultRemote?.baseUrl,
 		apiKey: overrideRemote?.apiKey ?? defaultRemote?.apiKey,
 		headers: overrideRemote?.headers ?? defaultRemote?.headers,
+		allowSessionContent: overrideRemote?.allowSessionContent ?? defaultRemote?.allowSessionContent ?? false,
 		batch
 	} : undefined;
 	const fallback = overrides?.fallback ?? defaults?.fallback ?? "none";
@@ -146,7 +147,12 @@ function mergeConfig(defaults, overrides, agentId) {
 		modelPath: overrides?.local?.modelPath ?? defaults?.local?.modelPath,
 		modelCacheDir: overrides?.local?.modelCacheDir ?? defaults?.local?.modelCacheDir
 	};
-	const sources = normalizeSources(overrides?.sources ?? defaults?.sources, sessionMemory);
+	const requestedSources = normalizeSources(overrides?.sources ?? defaults?.sources, sessionMemory);
+	const usesRemoteEmbedding = provider !== "local" && provider !== "ollama";
+	const sources = usesRemoteEmbedding && !remote?.allowSessionContent ? requestedSources.filter((source) => source !== "sessions") : requestedSources;
+	if (sources.length === 0) {
+		sources.push("memory");
+	}
 	const rawPaths = [...defaults?.extraPaths ?? [], ...overrides?.extraPaths ?? []].map((value) => value.trim()).filter(Boolean);
 	const extraPaths = Array.from(new Set(rawPaths));
 	const vector = {

package/dist/agents/model-catalog-access.js

@@ -42,8 +42,7 @@ function buildCredentialScopedAllowedModelSet(params) {
 		cfg: params.cfg,
 		catalog: usableCatalog,
 		defaultProvider: params.defaultProvider,
-		defaultModel: params.defaultModel,
-		additionalAllowedProviders: usableProviders
+		defaultModel: params.defaultModel
 	});
 	const allowedCatalog = filterModelCatalogByProviders(allowed.allowedCatalog, usableProviders);
 	const allowedKeys = new Set(allowedCatalog.map((entry) => modelKey(entry.provider, entry.id)));

package/dist/agents/model-catalog-snapshot.js

@@ -103,7 +103,7 @@ async function resolveCanonicalModelCatalogSnapshot(params) {
 			...model,
 			metadata,
 			available: true,
-			runnable: runnableRefs.size === 0 || runnableRefs.has(modelRef(model)),
+			runnable: authenticated.allowAny || runnableRefs.has(modelRef(model)),
 			recommended: metadata.recommended === true,
 			assignedRoles: assignmentsByRef.get(modelRef(model)) ?? []
 		};

package/dist/agents/model-catalog-source.js

@@ -1,5 +1,5 @@
-import { isOpenAISignInRuntimeModelSupported, isStandardProviderCatalogEntry, listProviderBrandManifests } from "../providers/registry.js";
 import { MODEL_APIS } from "../config/types.models.js";
+import { isOpenAISignInRuntimeModelSupported, isStandardProviderCatalogEntry, listProviderBrandManifests } from "../providers/registry.js";
 import { buildModelCatalogMergeKey, mergeModelCatalogRowsByAuthority, normalizeModelCatalogModelId, normalizeModelCatalogProviderId, normalizeProviderCatalogRows } from "./model-catalog-normalized.js";
 import { CURRENT_MODEL_PROVIDER_CATALOG, listCurrentModelCatalogRows } from "./current-model-catalog.js";
 import { deriveModelMetadata } from "./model-metadata.js";

package/dist/agents/model-metadata.js

@@ -1,6 +1,6 @@
 import { resolveModelThinkingCapability } from "../shared/model-thinking.js";
-import { getProviderBrandManifestForRoute, lookupProviderManifestModelCapability, providerModelRecommendationRank } from "../providers/registry.js";
 import { isPrivateNetworkBaseUrl } from "../utils/private-network-url.js";
+import { getProviderBrandManifestForRoute, lookupProviderManifestModelCapability, providerModelRecommendationRank } from "../providers/registry.js";
 import { lookupRefreshedModelCapability } from "../providers/refreshed-model-capabilities.js";
 
 //#region src/agents/model-metadata.ts

package/dist/agents/model-selection.js

@@ -1,7 +1,6 @@
 import { resolveAgentModelFallbackValues, resolveAgentModelPrimaryValue, toAgentModelListLike } from "../config/model-input.js";
 import { createSubsystemLogger } from "../logging/subsystem.js";
 import { resolveAgentConfig, resolveAgentEffectiveModelPrimary } from "./agent-scope.js";
-import { isStandardProviderModelRef } from "../providers/registry.js";
 import { DEFAULT_MODEL, DEFAULT_PROVIDER } from "./defaults.js";
 import { splitTrailingAuthProfile } from "./model-ref-profile.js";
 import { normalizeGoogleModelId } from "./models-config.providers.js";
@@ -418,7 +417,6 @@ function buildAllowedModelSet(params) {
 		defaultModel: params.defaultModel
 	});
 	const catalogKeys = new Set(params.catalog.map((entry) => modelKey(entry.provider, entry.id)));
-	const additionalAllowedProviders = new Set([...params.additionalAllowedProviders ?? []].map((provider) => normalizeProviderId(provider)).filter(Boolean));
 	if (allowAny) {
 		for (const key of defaultKeys) {
 			catalogKeys.add(key);
@@ -449,22 +447,7 @@ function buildAllowedModelSet(params) {
 	for (const key of defaultKeys) {
 		allowedKeys.add(key);
 	}
-	for (const entry of params.catalog) {
-		if (additionalAllowedProviders.has(normalizeProviderId(entry.provider))) {
-			allowedKeys.add(modelKey(entry.provider, entry.id));
-		}
-	}
 	const allowedCatalog = [...params.catalog.filter((entry) => allowedKeys.has(modelKey(entry.provider, entry.id))), ...syntheticCatalogEntries.values()];
-	if (allowedCatalog.length === 0 && allowedKeys.size === 0) {
-		for (const key of defaultKeys) {
-			catalogKeys.add(key);
-		}
-		return {
-			allowAny: true,
-			allowedCatalog: params.catalog,
-			allowedKeys: catalogKeys
-		};
-	}
 	return {
 		allowAny: false,
 		allowedCatalog,
@@ -476,8 +459,7 @@ function getModelRefStatus(params) {
 		cfg: params.cfg,
 		catalog: params.catalog,
 		defaultProvider: params.defaultProvider,
-		defaultModel: params.defaultModel,
-		additionalAllowedProviders: params.additionalAllowedProviders
+		defaultModel: params.defaultModel
 	});
 	const key = modelKey(params.ref.provider, params.ref.model);
 	return {
@@ -509,17 +491,9 @@ function resolveAllowedModelRef(params) {
 		catalog: params.catalog,
 		ref: resolved.ref,
 		defaultProvider: params.defaultProvider,
-		defaultModel: params.defaultModel,
-		additionalAllowedProviders: params.additionalAllowedProviders
+		defaultModel: params.defaultModel
 	});
 	if (!status.allowed) {
-		const additionalAllowedProviders = new Set([...params.additionalAllowedProviders ?? []].map((provider) => normalizeProviderId(provider)));
-		if (additionalAllowedProviders.has(normalizeProviderId(resolved.ref.provider)) && isStandardProviderModelRef(status.key)) {
-			return {
-				ref: resolved.ref,
-				key: status.key
-			};
-		}
 		return { error: `model not allowed: ${status.key}` };
 	}
 	return {

package/dist/agents/models-config.providers.js

@@ -1,19 +1,19 @@
 import { createSubsystemLogger } from "../logging/subsystem.js";
-import { CLOUDFLARE_AI_GATEWAY_MODEL_CATALOG, buildCloudflareAiGatewayModelDefinition, resolveCloudflareAiGatewayBaseUrl } from "../providers/cloudflare-ai-gateway-shared.js";
-import { HUGGINGFACE_BASE_URL, HUGGINGFACE_MODEL_CATALOG, buildHuggingfaceModelDefinition } from "../providers/huggingface-models.js";
-import { SYNTHETIC_BASE_URL, SYNTHETIC_MODEL_CATALOG, buildSyntheticModelDefinition } from "../providers/synthetic-models.js";
-import { TOGETHER_BASE_URL, TOGETHER_MODEL_CATALOG, buildTogetherModelDefinition } from "../providers/together-models.js";
-import { VENICE_BASE_URL } from "../providers/venice-models.js";
-import { XIAOMI_BASE_URL as XIAOMI_BASE_URL$1, XIAOMI_DEFAULT_MODEL_ID as XIAOMI_DEFAULT_MODEL_ID$1, XIAOMI_MODEL_IDS, buildXiaomiModelDefinition } from "../providers/xiaomi-models.js";
 import { coerceSecretRef } from "../config/types.secrets.js";
 import { DEFAULT_COPILOT_API_BASE_URL, resolveCopilotApiToken } from "../providers/github-copilot-token.js";
+import { XIAOMI_BASE_URL as XIAOMI_BASE_URL$1, XIAOMI_DEFAULT_MODEL_ID as XIAOMI_DEFAULT_MODEL_ID$1, XIAOMI_MODEL_IDS, buildXiaomiModelDefinition } from "../providers/xiaomi-models.js";
 import { normalizeOptionalSecretInput } from "../utils/normalize-secret-input.js";
 import { isPrivateNetworkBaseUrl } from "../utils/private-network-url.js";
 import { ensureAuthProfileStore } from "./auth-profiles/store.js";
 import { listProfilesForProvider } from "./auth-profiles/profiles.js";
 import "./auth-profiles.js";
 import { BYTEPLUS_BASE_URL, BYTEPLUS_CODING_BASE_URL, BYTEPLUS_CODING_MODEL_CATALOG, BYTEPLUS_MODEL_CATALOG, buildBytePlusModelDefinition } from "./byteplus-models.js";
+import { CLOUDFLARE_AI_GATEWAY_MODEL_CATALOG, buildCloudflareAiGatewayModelDefinition, resolveCloudflareAiGatewayBaseUrl } from "../providers/cloudflare-ai-gateway-shared.js";
 import "./cloudflare-ai-gateway.js";
+import { HUGGINGFACE_BASE_URL, HUGGINGFACE_MODEL_CATALOG, buildHuggingfaceModelDefinition } from "../providers/huggingface-models.js";
+import { SYNTHETIC_BASE_URL, SYNTHETIC_MODEL_CATALOG, buildSyntheticModelDefinition } from "../providers/synthetic-models.js";
+import { TOGETHER_BASE_URL, TOGETHER_MODEL_CATALOG, buildTogetherModelDefinition } from "../providers/together-models.js";
+import { VENICE_BASE_URL } from "../providers/venice-models.js";
 import { DOUBAO_BASE_URL, DOUBAO_CODING_BASE_URL, DOUBAO_CODING_MODEL_CATALOG, DOUBAO_MODEL_CATALOG, buildDoubaoModelDefinition } from "./doubao-models.js";
 import { discoverHuggingfaceModels } from "./huggingface-models.js";
 import "./synthetic-models.js";

package/dist/agents/openai-codex-app-server.js

@@ -1,6 +1,6 @@
 import { resolveFasedAgentPackageRootSync } from "../infra/fased-root.js";
 import { resolvePluginInstallDir } from "../plugins/install.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawn } from "node:child_process";
@@ -60,17 +60,17 @@ function resolveOpenAICodexExecutable() {
 	const explicitlyConfigured = process.env.FASED_CODEX_BIN?.trim();
 	for (const candidate of codexExecutableCandidates()) {
 		try {
-			if (!fs.statSync(candidate).isFile()) {
+			if (!syncFs.statSync(candidate).isFile()) {
 				continue;
 			}
 			if (explicitlyConfigured && candidate === explicitlyConfigured) {
 				return candidate;
 			}
-			const resolved = fs.realpathSync(candidate);
+			const resolved = syncFs.realpathSync(candidate);
 			let current = path.dirname(resolved);
 			for (let depth = 0; depth < 6; depth += 1) {
 				try {
-					const parsed = JSON.parse(fs.readFileSync(path.join(current, "package.json"), "utf8"));
+					const parsed = JSON.parse(syncFs.readFileSync(path.join(current, "package.json"), "utf8"));
 					if (parsed.name === "@openai/codex") {
 						if (parsed.version === OPENAI_CODEX_APP_SERVER_VERSION) {
 							return candidate;
@@ -90,7 +90,7 @@ function resolveOpenAICodexExecutable() {
 }
 function managedCodexHome() {
 	const directory = path.join(stateDir(), "runtime", "openai-codex");
-	fs.mkdirSync(directory, {
+	syncFs.mkdirSync(directory, {
 		recursive: true,
 		mode: 448
 	});

package/dist/agents/pi-embedded-runner/compact.js

@@ -19,6 +19,7 @@ import { enqueueCommandInLane } from "../../process/command-queue.js";
 import { resolveSignalReactionLevel } from "../../signal/reaction-level.js";
 import { resolveTelegramInlineButtonsScope } from "../../telegram/inline-buttons.js";
 import { resolveTelegramReactionLevel } from "../../telegram/reaction-level.js";
+import { marketplaceSkillIdsFromEntries, marketplaceSkillIdsFromSnapshot } from "../skills/trust.js";
 import { formatUserTime, resolveUserTimeFormat, resolveUserTimezone } from "../date-time.js";
 import { buildModelAliasLines } from "../model-alias-lines.js";
 import { resolveModelForExecution } from "./model.js";
@@ -29,13 +30,13 @@ import { listChannelSupportedActions, resolveChannelMessageToolHints } from "../
 import { resolveFasedAgentDocsPath } from "../docs-path.js";
 import { createPreparedEmbeddedPiSettingsManager } from "../pi-project-settings.js";
 import { detectRuntimeShell } from "../shell-utils.js";
+import { applySkillEnvOverrides, applySkillEnvOverridesFromSnapshot } from "../skills/env-overrides.js";
 import { createFasedAgentCodingTools } from "../pi-tools.js";
 import { registerProviderStreamForModel } from "../provider-stream.js";
 import { repairSessionFileIfNeeded } from "../session-file-repair.js";
 import { log } from "./logger.js";
 import { sanitizeToolUseResultPairing } from "../session-transcript-repair.js";
 import { guardSessionManager } from "../session-tool-result-guard-wrapper.js";
-import { applySkillEnvOverrides, applySkillEnvOverridesFromSnapshot } from "../skills/env-overrides.js";
 import { loadWorkspaceSkillEntries, resolveSkillsPromptForRun } from "../skills/workspace.js";
 import "../skills.js";
 import { resolveTranscriptPolicy } from "../transcript-policy.js";
@@ -205,10 +206,14 @@ async function compactEmbeddedPiSessionDirect(params) {
 	}
 	await fs.mkdir(resolvedWorkspace, { recursive: true });
 	const sandboxSessionKey = params.sessionKey?.trim() || params.sessionId;
+	const sourceSkillEntries = params.skillsSnapshot ? [] : loadWorkspaceSkillEntries(resolvedWorkspace, { config: params.config });
+	const marketplaceSkillIds = params.skillsSnapshot ? marketplaceSkillIdsFromSnapshot(params.skillsSnapshot) : marketplaceSkillIdsFromEntries(sourceSkillEntries);
+	const hasUntrustedSkillContent = marketplaceSkillIds.length > 0;
 	const sandbox = await resolveSandboxContext({
 		config: params.config,
 		sessionKey: sandboxSessionKey,
-		workspaceDir: resolvedWorkspace
+		workspaceDir: resolvedWorkspace,
+		forceUntrustedIsolation: hasUntrustedSkillContent
 	});
 	const effectiveWorkspace = sandbox?.enabled ? sandbox.workspaceAccess === "rw" ? resolvedWorkspace : sandbox.workspaceDir : resolvedWorkspace;
 	await fs.mkdir(effectiveWorkspace, { recursive: true });
@@ -224,10 +229,12 @@ async function compactEmbeddedPiSessionDirect(params) {
 		const skillEntries = shouldLoadSkillEntries ? loadWorkspaceSkillEntries(effectiveWorkspace) : [];
 		restoreSkillEnv = params.skillsSnapshot ? applySkillEnvOverridesFromSnapshot({
 			snapshot: params.skillsSnapshot,
-			config: params.config
+			config: params.config,
+			excludeMarketplace: true
 		}) : applySkillEnvOverrides({
 			skills: skillEntries ?? [],
-			config: params.config
+			config: params.config,
+			excludeMarketplace: true
 		});
 		const skillsPrompt = resolveSkillsPromptForRun({
 			skillsSnapshot: params.skillsSnapshot,
@@ -265,7 +272,8 @@ async function compactEmbeddedPiSessionDirect(params) {
 			modelProvider: model.provider,
 			modelId,
 			modelContextWindowTokens: model.contextWindow,
-			modelAuthMode: resolveModelAuthMode(model.provider, params.config)
+			modelAuthMode: resolveModelAuthMode(model.provider, params.config),
+			untrustedSkillContent: hasUntrustedSkillContent
 		});
 		const tools = sanitizeToolsForGoogle({
 			tools: toolsRaw,
@@ -433,7 +441,7 @@ async function compactEmbeddedPiSessionDirect(params) {
 				});
 				await resourceLoader.reload();
 			}
-			const { builtInTools, customTools } = splitSdkTools({
+			const { activeToolNames, customTools } = splitSdkTools({
 				tools,
 				sandboxEnabled: !!sandbox?.enabled
 			});
@@ -452,7 +460,7 @@ async function compactEmbeddedPiSessionDirect(params) {
 				modelRegistry,
 				model,
 				thinkingLevel: mapThinkingLevel(params.thinkLevel),
-				tools: builtInTools,
+				tools: activeToolNames,
 				customTools,
 				sessionManager,
 				settingsManager,

package/dist/agents/pi-embedded-runner/model.js

@@ -1,9 +1,9 @@
-import { isOpenAISignInRuntimeModelSupported } from "../../providers/registry.js";
 import { DEFAULT_CONTEXT_TOKENS } from "../defaults.js";
 import { isPrivateNetworkBaseUrl } from "../../utils/private-network-url.js";
 import { resolveFasedAgentAgentDir } from "../agent-paths.js";
 import { ensureAuthProfileStore } from "../auth-profiles/store.js";
 import "../auth-profiles.js";
+import { isOpenAISignInRuntimeModelSupported } from "../../providers/registry.js";
 import { normalizeProviderId } from "../model-selection.js";
 import { discoverAuthStorage, discoverModels } from "../pi-model-discovery.js";
 import { resolveAuthenticatedModelCatalog } from "../authenticated-model-catalog.js";

package/dist/agents/pi-embedded-runner/run/attempt.js

@@ -20,6 +20,7 @@ import { resolveTelegramInlineButtonsScope } from "../../../telegram/inline-butt
 import { resolveTelegramReactionLevel } from "../../../telegram/reaction-level.js";
 import { MAX_IMAGE_BYTES } from "../../../media/constants.js";
 import { resolveImageSanitizationLimits } from "../../image-sanitization.js";
+import { marketplaceSkillIdsFromEntries, marketplaceSkillIdsFromSnapshot } from "../../skills/trust.js";
 import { buildModelAliasLines } from "../../model-alias-lines.js";
 import "../model.js";
 import { buildTtsSystemPromptHint } from "../../../tts/tts.js";
@@ -29,6 +30,7 @@ import { listChannelSupportedActions, resolveChannelMessageToolHints } from "../
 import { resolveFasedAgentDocsPath } from "../../docs-path.js";
 import { createPreparedEmbeddedPiSettingsManager } from "../../pi-project-settings.js";
 import { detectRuntimeShell } from "../../shell-utils.js";
+import { applySkillEnvOverrides, applySkillEnvOverridesFromSnapshot } from "../../skills/env-overrides.js";
 import { isTimeoutError } from "../../failover-error.js";
 import { resolveSandboxRuntimeStatus } from "../../sandbox/runtime-status.js";
 import { resolveEffectiveToolFsWorkspaceOnly } from "../../tool-fs-policy.js";
@@ -39,7 +41,6 @@ import { log } from "../logger.js";
 import { sanitizeToolCallIdsForCloudCodeAssist } from "../../tool-call-id.js";
 import { sanitizeToolUseResultPairing } from "../../session-transcript-repair.js";
 import { guardSessionManager } from "../../session-tool-result-guard-wrapper.js";
-import { applySkillEnvOverrides, applySkillEnvOverridesFromSnapshot } from "../../skills/env-overrides.js";
 import { loadWorkspaceSkillEntries, resolveSkillsPromptForRun } from "../../skills/workspace.js";
 import "../../skills.js";
 import { resolveTranscriptPolicy } from "../../transcript-policy.js";
@@ -245,10 +246,17 @@ async function runEmbeddedAttempt(params) {
 	log.debug(`embedded run start: runId=${params.runId} sessionId=${params.sessionId} provider=${params.provider} model=${params.modelId} thinking=${params.thinkLevel} messageChannel=${params.messageChannel ?? params.messageProvider ?? "unknown"}`);
 	await fs.mkdir(resolvedWorkspace, { recursive: true });
 	const sandboxSessionKey = params.sessionKey?.trim() || params.sessionId;
+	const sourceSkillEntries = params.skillsSnapshot ? [] : loadWorkspaceSkillEntries(resolvedWorkspace, {
+		config: params.config,
+		agentId: params.agentId
+	});
+	const marketplaceSkillIds = params.skillsSnapshot ? marketplaceSkillIdsFromSnapshot(params.skillsSnapshot) : marketplaceSkillIdsFromEntries(sourceSkillEntries);
+	const hasUntrustedSkillContent = marketplaceSkillIds.length > 0;
 	const sandbox = await resolveSandboxContext({
 		config: params.config,
 		sessionKey: sandboxSessionKey,
-		workspaceDir: resolvedWorkspace
+		workspaceDir: resolvedWorkspace,
+		forceUntrustedIsolation: hasUntrustedSkillContent
 	});
 	const effectiveWorkspace = sandbox?.enabled ? sandbox.workspaceAccess === "rw" ? resolvedWorkspace : sandbox.workspaceDir : resolvedWorkspace;
 	await fs.mkdir(effectiveWorkspace, { recursive: true });
@@ -260,10 +268,12 @@ async function runEmbeddedAttempt(params) {
 		const skillEntries = shouldLoadSkillEntries ? loadWorkspaceSkillEntries(effectiveWorkspace) : [];
 		restoreSkillEnv = params.skillsSnapshot ? applySkillEnvOverridesFromSnapshot({
 			snapshot: params.skillsSnapshot,
-			config: params.config
+			config: params.config,
+			excludeMarketplace: true
 		}) : applySkillEnvOverrides({
 			skills: skillEntries ?? [],
-			config: params.config
+			config: params.config,
+			excludeMarketplace: true
 		});
 		const skillsPrompt = resolveSkillsPromptForRun({
 			skillsSnapshot: params.skillsSnapshot,
@@ -333,9 +343,10 @@ async function runEmbeddedAttempt(params) {
 			modelHasVision,
 			requireExplicitMessageTarget: params.requireExplicitMessageTarget ?? isSubagentSessionKey(params.sessionKey),
 			disableMessageTool: params.disableMessageTool,
-			disabledToolNames: params.disabledToolNames
+			disabledToolNames: params.disabledToolNames,
+			untrustedSkillContent: hasUntrustedSkillContent
 		});
-		if (!toolsDisabled) {
+		if (!toolsDisabled && !hasUntrustedSkillContent) {
 			bundleMcpRuntime = await createBundleMcpToolRuntime({
 				workspaceDir: effectiveWorkspace,
 				cfg: params.config,
@@ -561,10 +572,6 @@ async function runEmbeddedAttempt(params) {
 				await resourceLoader.reload();
 			}
 			const hookRunner = getGlobalHookRunner();
-			const { builtInTools, customTools } = splitSdkTools({
-				tools,
-				sandboxEnabled: !!sandbox?.enabled
-			});
 			let clientToolCallDetected = null;
 			const clientToolLoopDetection = resolveToolLoopDetectionConfig({
 				cfg: params.config,
@@ -580,7 +587,11 @@ async function runEmbeddedAttempt(params) {
 				sessionKey: params.sessionKey,
 				loopDetection: clientToolLoopDetection
 			}) : [];
-			const allCustomTools = [...customTools, ...clientToolDefs];
+			const { activeToolNames, customTools } = splitSdkTools({
+				tools,
+				clientTools: clientToolDefs,
+				sandboxEnabled: !!sandbox?.enabled
+			});
 			if (params.model.api === "ollama") {
 				registerProviderStreamForModel({
 					model: params.model,
@@ -596,8 +607,8 @@ async function runEmbeddedAttempt(params) {
 				modelRegistry: params.modelRegistry,
 				model: params.model,
 				thinkingLevel: mapThinkingLevel(params.thinkLevel),
-				tools: builtInTools,
-				customTools: allCustomTools,
+				tools: activeToolNames,
+				customTools,
 				sessionManager,
 				settingsManager,
 				resourceLoader

package/dist/agents/pi-embedded-runner/run.js

@@ -460,7 +460,9 @@ async function runEmbeddedPiAgent(params) {
 					skillsSnapshot: params.skillsSnapshot,
 					prompt,
 					images: params.images,
+					clientTools: params.clientTools,
 					disableTools: params.disableTools,
+					disabledToolNames: params.disabledToolNames,
 					provider,
 					modelId,
 					model,

package/dist/agents/pi-embedded-runner/tool-split.js

@@ -1,11 +1,49 @@
+import { isKnownCoreToolId } from "../tool-catalog.js";
+import { normalizeToolName } from "../tool-policy-shared.js";
+import "../tool-policy.js";
 import { toToolDefinitions } from "../pi-tool-definition-adapter.js";
 
 //#region src/agents/pi-embedded-runner/tool-split.ts
+const SDK_BUILT_IN_TOOL_NAMES = new Set([
+	"read",
+	"bash",
+	"edit",
+	"write",
+	"grep",
+	"find",
+	"ls"
+].map(normalizeToolName));
+function validateClientToolDefinitions(params) {
+	const fasedToolNames = new Set(params.fasedTools.map((tool) => normalizeToolName(tool.name)));
+	const clientToolNames = new Set();
+	for (const tool of params.clientTools) {
+		const name = tool.name;
+		const trimmedName = name.trim();
+		if (!trimmedName || trimmedName !== name) {
+			throw new Error("Client tool names must be non-empty and must not contain outer whitespace");
+		}
+		const normalizedName = normalizeToolName(name);
+		if (SDK_BUILT_IN_TOOL_NAMES.has(normalizedName) || isKnownCoreToolId(normalizedName) || fasedToolNames.has(normalizedName)) {
+			throw new Error(`Client tool name "${name}" is reserved by Fased`);
+		}
+		if (clientToolNames.has(normalizedName)) {
+			throw new Error(`Duplicate client tool name: "${name}"`);
+		}
+		clientToolNames.add(normalizedName);
+	}
+}
 function splitSdkTools(options) {
 	const { tools } = options;
+	const fasedTools = toToolDefinitions(tools);
+	const clientTools = options.clientTools ?? [];
+	validateClientToolDefinitions({
+		fasedTools,
+		clientTools
+	});
+	const customTools = [...fasedTools, ...clientTools];
 	return {
-		builtInTools: [],
-		customTools: toToolDefinitions(tools)
+		activeToolNames: customTools.map((tool) => tool.name),
+		customTools
 	};
 }
 

package/dist/agents/pi-embedded-subscribe.raw-stream.js

@@ -1,6 +1,6 @@
 import { resolveStateDir } from "../config/paths.js";
 import { isTruthyEnvValue } from "../infra/env.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/agents/pi-embedded-subscribe.raw-stream.ts
@@ -14,11 +14,11 @@ function appendRawStream(payload) {
 	if (!rawStreamReady) {
 		rawStreamReady = true;
 		try {
-			fs.mkdirSync(path.dirname(RAW_STREAM_PATH), { recursive: true });
+			syncFs.mkdirSync(path.dirname(RAW_STREAM_PATH), { recursive: true });
 		} catch {}
 	}
 	try {
-		void fs.promises.appendFile(RAW_STREAM_PATH, `${JSON.stringify(payload)}\n`);
+		void syncFs.promises.appendFile(RAW_STREAM_PATH, `${JSON.stringify(payload)}\n`);
 	} catch {}
 }
 

package/dist/agents/pi-extensions/compaction-safeguard.js

@@ -3,7 +3,7 @@ import { getCompactionSafeguardRuntime } from "./compaction-safeguard-runtime.js
 import { extractSections } from "../../auto-reply/reply/post-compaction-context.js";
 import { BASE_CHUNK_RATIO, MIN_CHUNK_RATIO, SAFETY_MARGIN, SUMMARIZATION_OVERHEAD_TOKENS, computeAdaptiveChunkRatio, estimateMessagesTokens, isOversizedForSummary, pruneHistoryForContextShare, resolveContextWindowTokens, summarizeInStages } from "../compaction.js";
 import { collectTextContentBlocks } from "../content-blocks.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/agents/pi-extensions/compaction-safeguard.ts
@@ -122,10 +122,10 @@ async function readWorkspaceContextForSummary() {
 	const workspaceDir = process.cwd();
 	const agentsPath = path.join(workspaceDir, "AGENTS.md");
 	try {
-		if (!fs.existsSync(agentsPath)) {
+		if (!syncFs.existsSync(agentsPath)) {
 			return "";
 		}
-		const content = await fs.promises.readFile(agentsPath, "utf-8");
+		const content = await syncFs.promises.readFile(agentsPath, "utf-8");
 		const sections = extractSections(content, ["Session Startup", "Red Lines"]);
 		if (sections.length === 0) {
 			return "";

package/dist/agents/pi-model-discovery.js

@@ -1,7 +1,7 @@
 import { ensureAuthProfileStore } from "./auth-profiles/store.js";
 import "./auth-profiles.js";
 import { resolvePiCredentialMapFromStore } from "./pi-auth-credentials.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 import * as PiCodingAgent from "@mariozechner/pi-coding-agent";
 
@@ -25,12 +25,12 @@ function scrubLegacyStaticAuthJsonEntries(pathname) {
 	if (process.env.FASED_AUTH_STORE_READONLY === "1") {
 		return;
 	}
-	if (!fs.existsSync(pathname)) {
+	if (!syncFs.existsSync(pathname)) {
 		return;
 	}
 	let parsed;
 	try {
-		parsed = JSON.parse(fs.readFileSync(pathname, "utf8"));
+		parsed = JSON.parse(syncFs.readFileSync(pathname, "utf8"));
 	} catch {
 		return;
 	}
@@ -52,11 +52,11 @@ function scrubLegacyStaticAuthJsonEntries(pathname) {
 		return;
 	}
 	if (Object.keys(parsed).length === 0) {
-		fs.rmSync(pathname, { force: true });
+		syncFs.rmSync(pathname, { force: true });
 		return;
 	}
-	fs.writeFileSync(pathname, `${JSON.stringify(parsed, null, 2)}\n`, "utf8");
-	fs.chmodSync(pathname, 384);
+	syncFs.writeFileSync(pathname, `${JSON.stringify(parsed, null, 2)}\n`, "utf8");
+	syncFs.chmodSync(pathname, 384);
 }
 function createAuthStorage(AuthStorageLike, path, creds) {
 	const withInMemory = AuthStorageLike;