@frontmcp/plugin-skilled-openapi 1.4.0 → 1.5.0-rc.1

package/index.js

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,6 +17,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var __decorateClass = (decorators, target, key2, kind) => {
   var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key2) : target;
@@ -28,6 +38,7 @@ var __decorateClass = (decorators, target, key2, kind) => {
 // plugins/plugin-skilled-openapi/src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  SKILLED_OPENAPI_RUNTIME_DEPS_TOKEN: () => SKILLED_OPENAPI_RUNTIME_DEPS_TOKEN,
   SkilledOpenApiConfig: () => SkilledOpenApiConfig,
   SkilledOpenApiCredentialResolver: () => SkilledOpenApiCredentialResolver,
   SkilledOpenApiPlugin: () => SkilledOpenApiPlugin,
@@ -86,6 +97,19 @@ var HiddenOpRegistry = class {
   get(skillId, actionId) {
     return this.entries.get(key(skillId, actionId));
   }
+  /**
+   * Resolve an operation by actionId (operationId) ALONE — used by the enclave
+   * codecall (`run_workflow`), where a sandboxed script calls
+   * `callTool(actionId, input)` without naming the owning skill. operationIds
+   * are unique within a bundle, so the first match is authoritative; returns
+   * undefined when no loaded skill exposes the action.
+   */
+  getByActionId(actionId) {
+    for (const entry of this.entries.values()) {
+      if (entry.op.operationId === actionId) return entry;
+    }
+    return void 0;
+  }
   /** Set or replace the entry for `(skillId, actionId)`. */
   set(entry) {
     this.entries.set(key(entry.skillId, entry.op.operationId), entry);
@@ -133,13 +157,31 @@ var AuthorityGuard = class {
     this.logger = opts.logger;
   }
   async check(args) {
-    const { policy, authInfo, input, env } = args;
-    if (policy === void 0) {
+    const { policy, skillPolicy, isPublic, authInfo, input, env } = args;
+    const unprotectedOps = args.unprotectedOps ?? "allow";
+    const policies = [skillPolicy, policy].filter((p) => p !== void 0 && p !== null);
+    if (policies.length === 0) {
+      if (unprotectedOps === "deny" && isPublic !== true) {
+        return {
+          granted: false,
+          deniedBy: "unprotected_operation_denied",
+          message: 'operation has no required-authorities policy and is not marked public; blocked by unprotectedOps:"deny" (set the op `public: true` or attach a policy)',
+          evaluatedPolicies: []
+        };
+      }
       return { granted: true, evaluatedPolicies: [] };
     }
     try {
       const ctx = this.contextBuilder.build(authInfo, input, env);
-      return await this.engine.evaluate(policy, ctx);
+      const evaluatedPolicies = [];
+      for (const p of policies) {
+        const res = await this.engine.evaluate(p, ctx);
+        evaluatedPolicies.push(...res.evaluatedPolicies ?? []);
+        if (!res.granted) {
+          return { ...res, evaluatedPolicies };
+        }
+      }
+      return { granted: true, evaluatedPolicies };
     } catch (e) {
       const message = normalizeCaughtMessage(e);
       this.logger?.error(`[skilled-openapi:authority] evaluation failed: ${message}`);
@@ -166,9 +208,14 @@ var SkilledOpenApiConfig = class {
   constructor(options) {
     this.options = options;
   }
+  options;
   get outbound() {
     return this.options.outbound;
   }
+  /** Default-deny policy for ops with no required-authorities (C1/C3). */
+  get unprotectedOps() {
+    return this.options.unprotectedOps;
+  }
 };
 var SkilledOpenApiCredentialResolver = class {
 };
@@ -225,6 +272,20 @@ var skilledOpenApiPluginOptionsObjectSchema = import_lazy_zod.z.object({
   dev: import_lazy_zod.z.boolean().default(false),
   /** Outbound HTTP / SSRF defenses for the executor. */
   outbound: outboundOptionsSchema,
+  /**
+   * How to treat operations that carry NO required-authorities policy (neither
+   * skill-level nor op-level) on the execution surface (`run_workflow` and the
+   * internal per-op tools):
+   *
+   * - `'allow'` (default, backward compatible): policy-less ops are callable —
+   *   origin trust comes from the signed bundle. Appropriate when every op in
+   *   the bundle is genuinely public (e.g. a public REST API).
+   * - `'deny'`: default-deny the execution surface — a policy-less op is blocked
+   *   unless the bundle explicitly marks it `public: true`. **Recommended for
+   *   production**: it ensures a single missing `requiredAuthorities` line can't
+   *   silently expose a protected op (closes SECURITY-REVIEW C1/C3).
+   */
+  unprotectedOps: import_lazy_zod.z.enum(["allow", "deny"]).default("allow"),
   /**
    * Source-conflict policy when more than one source registers a skill with
    * the same id. Default: locally-pinned static beats npm beats saas.
@@ -291,6 +352,12 @@ var BundleSyncService = class {
     this.logger = logger;
     this.operationToolFactory = operationToolFactory;
   }
+  skillRegistry;
+  hiddenOps;
+  bundleStore;
+  options;
+  logger;
+  operationToolFactory;
   skillUnregisterByBundleId = /* @__PURE__ */ new Map();
   /**
    * Validate signature and apply the bundle. Returns a structured result;
@@ -485,6 +552,11 @@ var BundleSyncService = class {
         }
         const entry = {
           skillId: skill.id,
+          // Pin the skill-level policy so it is AND-ed with the op-level policy
+          // at execution time (C2 — previously this was silently dropped).
+          ...skill.requiredAuthorities !== void 0 && {
+            skillRequiredAuthorities: skill.requiredAuthorities
+          },
           op,
           service,
           authBinding,
@@ -506,15 +578,126 @@ function collectPathsWithGet(entries) {
   return set;
 }
 
-// plugins/plugin-skilled-openapi/src/tools/execute-action.tool.ts
-var import_skills4 = require("@frontmcp/adapters/skills");
+// plugins/plugin-skilled-openapi/src/tools/load-skill.tool.ts
 var import_sdk = require("@frontmcp/sdk");
 
+// plugins/plugin-skilled-openapi/src/tools/load-skill.schema.ts
+var import_lazy_zod2 = require("@frontmcp/lazy-zod");
+var loadSkillDescription = `Load the full instructions and executable actions for a specific skill.
+
+Use this AFTER \`search_skill\` once you've identified the right skill for the
+user's task. The returned object contains:
+  - \`instructions\`: markdown the LLM should read carefully before invoking
+  - \`actions\`: each action's input/output JSON Schema and required authorities
+  - \`bundleVersion\`: changes when the bundle is hot-swapped (use it to detect drift)
+
+INPUT: { skillId }
+OUTPUT: { skill: { id, name, description, instructions, actions[] }, isComplete }`;
+var loadSkillInputSchema = {
+  skillId: import_lazy_zod2.z.string().min(1).max(256).describe("Stable skill identifier (returned by search_skill)")
+};
+var loadSkillOutputSchema = {
+  skill: import_lazy_zod2.z.object({
+    id: import_lazy_zod2.z.string(),
+    name: import_lazy_zod2.z.string(),
+    description: import_lazy_zod2.z.string(),
+    instructions: import_lazy_zod2.z.string(),
+    bundleVersion: import_lazy_zod2.z.string().optional(),
+    actions: import_lazy_zod2.z.array(
+      import_lazy_zod2.z.object({
+        actionId: import_lazy_zod2.z.string(),
+        summary: import_lazy_zod2.z.string(),
+        description: import_lazy_zod2.z.string().optional(),
+        inputJsonSchema: import_lazy_zod2.z.record(import_lazy_zod2.z.string(), import_lazy_zod2.z.unknown()),
+        outputJsonSchema: import_lazy_zod2.z.record(import_lazy_zod2.z.string(), import_lazy_zod2.z.unknown()),
+        requiredAuthorities: import_lazy_zod2.z.record(import_lazy_zod2.z.string(), import_lazy_zod2.z.unknown()).optional()
+      })
+    ).optional()
+  }),
+  isComplete: import_lazy_zod2.z.boolean(),
+  warning: import_lazy_zod2.z.string().optional()
+};
+
+// plugins/plugin-skilled-openapi/src/tools/load-skill.tool.ts
+var LoadSkillTool = class extends import_sdk.ToolContext {
+  async execute(input) {
+    this.get(BundleSyncService);
+    const scope = this.get(import_sdk.ScopeEntry);
+    const skillRegistry = scope.skills;
+    if (!skillRegistry) {
+      throw new import_sdk.InternalMcpError("SkillRegistry is not available on the active scope", "SKILL_REGISTRY_UNAVAILABLE");
+    }
+    const result = await skillRegistry.loadSkill(input.skillId);
+    if (!result) {
+      throw new import_sdk.PublicMcpError(`Skill "${input.skillId}" not found`, "SKILL_NOT_FOUND", 404);
+    }
+    const skill = result.skill;
+    return {
+      skill: {
+        id: skill.id,
+        name: skill.name,
+        description: skill.description,
+        instructions: skill.instructions,
+        ...skill.bundleVersion !== void 0 && { bundleVersion: skill.bundleVersion },
+        ...skill.actions ? { actions: skill.actions } : {}
+      },
+      isComplete: result.isComplete,
+      ...result.warning !== void 0 && { warning: result.warning }
+    };
+  }
+};
+LoadSkillTool = __decorateClass([
+  (0, import_sdk.Tool)({
+    name: "load_skill",
+    description: loadSkillDescription,
+    inputSchema: loadSkillInputSchema,
+    outputSchema: loadSkillOutputSchema,
+    annotations: {
+      readOnlyHint: true,
+      openWorldHint: false
+    }
+  })
+], LoadSkillTool);
+
+// plugins/plugin-skilled-openapi/src/tools/operation-tool.factory.ts
+var import_skills4 = require("@frontmcp/adapters/skills");
+var import_sdk2 = require("@frontmcp/sdk");
+
 // plugins/plugin-skilled-openapi/src/executor/openapi-runtime.ts
 var import_openapi = require("@frontmcp/adapters/openapi");
 
+// plugins/plugin-skilled-openapi/src/executor/host-concurrency.ts
+var gates = /* @__PURE__ */ new Map();
+async function withHostConcurrency(host, limit, fn) {
+  if (!Number.isFinite(limit) || limit <= 0) {
+    return fn();
+  }
+  let gate = gates.get(host);
+  if (!gate) {
+    gate = { active: 0, queue: [] };
+    gates.set(host, gate);
+  }
+  if (gate.active >= limit) {
+    await new Promise((resolve) => gate.queue.push(resolve));
+  } else {
+    gate.active += 1;
+  }
+  try {
+    return await fn();
+  } finally {
+    const next = gate.queue.shift();
+    if (next) {
+      next();
+    } else {
+      gate.active -= 1;
+      if (gate.active <= 0 && gate.queue.length === 0) {
+        gates.delete(host);
+      }
+    }
+  }
+}
+
 // plugins/plugin-skilled-openapi/src/executor/ssrf-guard.ts
-var import_node_dns = require("node:dns");
 var PRIVATE_IPV4_BLOCKS = [
   // RFC 1918
   { net: ipv4ToInt("10.0.0.0"), mask: 4278190080 },
@@ -522,9 +705,14 @@ var PRIVATE_IPV4_BLOCKS = [
   { net: ipv4ToInt("192.168.0.0"), mask: 4294901760 },
   // Loopback
   { net: ipv4ToInt("127.0.0.0"), mask: 4278190080 },
+  // Carrier-grade NAT (RFC 6598) — routable-looking but private; a common
+  // SSRF blind spot (SECURITY-REVIEW B4).
+  { net: ipv4ToInt("100.64.0.0"), mask: 4290772992 }
+];
+var ALWAYS_FORBIDDEN_IPV4_BLOCKS = [
   // Link-local incl. AWS/GCP/Azure metadata 169.254.169.254
   { net: ipv4ToInt("169.254.0.0"), mask: 4294901760 },
-  // 0.0.0.0/8
+  // "this host on this network" / unspecified
   { net: ipv4ToInt("0.0.0.0"), mask: 4278190080 }
 ];
 function ipv4ToInt(ip) {
@@ -533,25 +721,61 @@ function ipv4ToInt(ip) {
   const [a, b, c, d] = parts;
   return a * 16777216 + (b << 16 >>> 0) + (c << 8 >>> 0) + d >>> 0;
 }
-function isPrivateIPv4(ip) {
-  if (!/^\d+\.\d+\.\d+\.\d+$/.test(ip)) return false;
-  const parts = ip.split(".").map((n) => parseInt(n, 10));
-  if (parts.some((p) => Number.isNaN(p) || p < 0 || p > 255)) return false;
+function isValidIPv4(ip) {
+  if (!/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(ip)) return false;
+  return ip.split(".").every((p) => {
+    const n = Number(p);
+    return n >= 0 && n <= 255;
+  });
+}
+function matchesBlock(ip, blocks) {
   const v = ipv4ToInt(ip);
-  return PRIVATE_IPV4_BLOCKS.some((b) => (v & b.mask) >>> 0 === b.net);
+  return blocks.some((b) => (v & b.mask) >>> 0 === b.net);
+}
+function isPrivateIPv4(ip) {
+  if (!isValidIPv4(ip)) return false;
+  return matchesBlock(ip, PRIVATE_IPV4_BLOCKS) || matchesBlock(ip, ALWAYS_FORBIDDEN_IPV4_BLOCKS);
+}
+function isAlwaysForbiddenIPv4(ip) {
+  if (!isValidIPv4(ip)) return false;
+  return matchesBlock(ip, ALWAYS_FORBIDDEN_IPV4_BLOCKS);
 }
 function isPrivateIPv6(ip) {
   const lower = ip.toLowerCase();
   if (lower === "::1" || lower === "::") return true;
   if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
-  if (lower.startsWith("fe80:")) return true;
+  if (lower.startsWith("fe80:") || lower.startsWith("fe80::")) return true;
   if (lower.startsWith("::ffff:")) {
     const v4 = lower.slice("::ffff:".length);
     return isPrivateIPv4(v4);
   }
   return false;
 }
-var FORBIDDEN_METADATA_HOSTS = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.azure.com", "metadata.aws.com"]);
+function isAlwaysForbiddenIPv6(ip) {
+  const lower = ip.toLowerCase();
+  if (lower.startsWith("fe80:") || lower.startsWith("fe80::")) return true;
+  if (lower === "fd00:ec2::254") return true;
+  if (lower === "::") return true;
+  if (lower.startsWith("::ffff:")) {
+    return isAlwaysForbiddenIPv4(lower.slice("::ffff:".length));
+  }
+  return false;
+}
+var FORBIDDEN_METADATA_HOSTS = /* @__PURE__ */ new Set([
+  "metadata.google.internal",
+  "metadata.azure.com",
+  "metadata.aws.com",
+  // GCP legacy + Alibaba/OpenStack-style metadata hostnames.
+  "metadata",
+  "metadata.goog"
+]);
+function classifyHostLiteral(hostname) {
+  let h = hostname;
+  if (h.startsWith("[") && h.endsWith("]")) h = h.slice(1, -1);
+  if (isValidIPv4(h)) return { kind: "v4", ip: h };
+  if (h.includes(":")) return { kind: "v6", ip: h };
+  return { kind: "name", ip: h };
+}
 async function checkOutboundUrl(target, allowedHosts, outbound) {
   let url;
   try {
@@ -569,21 +793,51 @@ async function checkOutboundUrl(target, allowedHosts, outbound) {
   if (!allowedHosts.has(hostname)) {
     return { ok: false, reason: `hostname "${hostname}" is not in the bundle's declared services` };
   }
-  if (outbound.allowPrivateNetworks) {
+  const literal = classifyHostLiteral(hostname);
+  if (literal.kind === "v4") {
+    if (isAlwaysForbiddenIPv4(literal.ip)) {
+      return { ok: false, reason: `metadata/link-local IPv4 ${literal.ip} is always blocked` };
+    }
+    if (!outbound.allowPrivateNetworks && isPrivateIPv4(literal.ip)) {
+      return { ok: false, reason: `private/loopback IPv4 ${literal.ip} is blocked` };
+    }
+    return { ok: true };
+  }
+  if (literal.kind === "v6") {
+    if (isAlwaysForbiddenIPv6(literal.ip)) {
+      return { ok: false, reason: `metadata/link-local IPv6 ${literal.ip} is always blocked` };
+    }
+    if (!outbound.allowPrivateNetworks && isPrivateIPv6(literal.ip)) {
+      return { ok: false, reason: `private IPv6 ${literal.ip} is blocked` };
+    }
     return { ok: true };
   }
   let addresses;
   try {
-    addresses = await import_node_dns.promises.lookup(hostname, { all: true });
+    const { promises: dns } = await import("node:dns");
+    addresses = await dns.lookup(literal.ip, { all: true });
   } catch (e) {
-    return { ok: false, reason: `DNS resolution failed for "${hostname}": ${e.message}` };
+    if (!outbound.allowPrivateNetworks) {
+      return { ok: false, reason: `DNS resolution failed for "${hostname}": ${e.message}` };
+    }
+    return { ok: true };
   }
   for (const a of addresses) {
-    if (a.family === 4 && isPrivateIPv4(a.address)) {
-      return { ok: false, reason: `host "${hostname}" resolved to private/loopback IPv4 ${a.address}` };
+    if (a.family === 4) {
+      if (isAlwaysForbiddenIPv4(a.address)) {
+        return { ok: false, reason: `host "${hostname}" resolved to metadata/link-local IPv4 ${a.address}` };
+      }
+      if (!outbound.allowPrivateNetworks && isPrivateIPv4(a.address)) {
+        return { ok: false, reason: `host "${hostname}" resolved to private/loopback IPv4 ${a.address}` };
+      }
     }
-    if (a.family === 6 && isPrivateIPv6(a.address)) {
-      return { ok: false, reason: `host "${hostname}" resolved to private IPv6 ${a.address}` };
+    if (a.family === 6) {
+      if (isAlwaysForbiddenIPv6(a.address)) {
+        return { ok: false, reason: `host "${hostname}" resolved to metadata/link-local IPv6 ${a.address}` };
+      }
+      if (!outbound.allowPrivateNetworks && isPrivateIPv6(a.address)) {
+        return { ok: false, reason: `host "${hostname}" resolved to private IPv6 ${a.address}` };
+      }
     }
   }
   return { ok: true };
@@ -668,7 +922,7 @@ function toMcpOpenAPITool(entry) {
   };
 }
 async function resolveSecurity(tool, ctx) {
-  const { SecurityResolver } = require("mcp-from-openapi");
+  const { SecurityResolver } = await import("mcp-from-openapi");
   const resolver = new SecurityResolver();
   return resolver.resolve(tool.mapper, ctx);
 }
@@ -711,79 +965,103 @@ async function executeOperation(args) {
   }
   const timeoutMs = entry.op.timeoutMs ?? outbound.defaultTimeoutMs;
   const maxBytes = entry.op.maxResponseBytes ?? outbound.defaultMaxResponseBytes;
-  const ac = new AbortController();
-  const timer = setTimeout(() => ac.abort(), timeoutMs);
-  timer.unref?.();
-  try {
-    const response = await fetchImpl(req.url, {
-      method: entry.op.httpMethod,
-      headers: req.headers,
-      body: req.body !== void 0 ? JSON.stringify(req.body) : void 0,
-      signal: ac.signal
-    });
-    const contentType = response.headers.get("content-type") ?? void 0;
-    const reader = response.body?.getReader();
-    let received = 0;
-    const chunks = [];
-    if (reader) {
-      for (; ; ) {
-        const { value, done } = await reader.read();
-        if (done) break;
-        if (value) {
-          received += value.byteLength;
-          if (received > maxBytes) {
-            return failure(response.status, `response exceeded maxResponseBytes (${maxBytes})`);
+  const host = (() => {
+    try {
+      return new URL(req.url).hostname.toLowerCase();
+    } catch {
+      return req.url;
+    }
+  })();
+  return withHostConcurrency(host, outbound.maxConcurrencyPerHost, async () => {
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(), timeoutMs);
+    timer.unref?.();
+    try {
+      const response = await fetchImpl(req.url, {
+        method: entry.op.httpMethod,
+        headers: req.headers,
+        body: req.body !== void 0 ? JSON.stringify(req.body) : void 0,
+        signal: ac.signal,
+        // SECURITY: never auto-follow redirects. `fetch` defaults to
+        // `redirect: 'follow'`, which re-sends the request — INCLUDING the
+        // vault-injected `Authorization`/api-key headers — to the redirect
+        // target, even cross-origin. An allowlisted-but-compromised (or
+        // open-redirecting) upstream could thus exfiltrate the credential to an
+        // attacker host, and the SSRF allowlist (validated only on the initial
+        // URL) would never re-evaluate the hop. `manual` makes the 3xx visible
+        // here so we can refuse it instead of following blindly.
+        redirect: "manual"
+      });
+      if (response.status >= 300 && response.status < 400) {
+        return failure(
+          response.status,
+          `upstream returned a redirect (${response.status}); not followed to protect injected credentials`
+        );
+      }
+      const contentType = response.headers.get("content-type") ?? void 0;
+      const reader = response.body?.getReader();
+      let received = 0;
+      const chunks = [];
+      if (reader) {
+        for (; ; ) {
+          const { value, done } = await reader.read();
+          if (done) break;
+          if (value) {
+            received += value.byteLength;
+            if (received > maxBytes) {
+              return failure(response.status, `response exceeded maxResponseBytes (${maxBytes})`);
+            }
+            chunks.push(value);
           }
-          chunks.push(value);
         }
       }
+      const buf = Buffer.concat(chunks.map((c) => Buffer.from(c)));
+      const synthetic = new Response(buf, {
+        status: response.status,
+        headers: response.headers
+      });
+      const parsed = await (0, import_openapi.parseResponse)(synthetic);
+      void logger;
+      return {
+        ok: response.ok,
+        status: response.status,
+        contentType,
+        data: parsed.data,
+        responseBytes: received
+      };
+    } catch (e) {
+      const err = e;
+      return failure(0, err.name === "AbortError" ? `timeout after ${timeoutMs}ms` : err.message);
+    } finally {
+      clearTimeout(timer);
     }
-    const buf = Buffer.concat(chunks.map((c) => Buffer.from(c)));
-    const synthetic = new Response(buf, {
-      status: response.status,
-      headers: response.headers
-    });
-    const parsed = await (0, import_openapi.parseResponse)(synthetic);
-    void logger;
-    return {
-      ok: response.ok,
-      status: response.status,
-      contentType,
-      data: parsed.data,
-      responseBytes: received
-    };
-  } catch (e) {
-    const err = e;
-    return failure(0, err.name === "AbortError" ? `timeout after ${timeoutMs}ms` : err.message);
-  } finally {
-    clearTimeout(timer);
-  }
+  });
 }
 function failure(status, error) {
   return { ok: false, status, data: null, error, responseBytes: 0 };
 }
 
 // plugins/plugin-skilled-openapi/src/executor/schema-cache.ts
-var import_lazy_zod2 = require("@frontmcp/lazy-zod");
+var import_lazy_zod3 = require("@frontmcp/lazy-zod");
 var compiled = /* @__PURE__ */ new Map();
 var cacheKey = (bundleVersion, opId) => `${bundleVersion}\0${opId}`;
 function compileOne(jsonSchema) {
   if (!jsonSchema || typeof jsonSchema !== "object") {
-    return { schema: import_lazy_zod2.z.looseObject({}), failed: true };
+    return { schema: import_lazy_zod3.z.looseObject({}), failed: true };
   }
   try {
-    const zodSchema = import_lazy_zod2.z.fromJSONSchema(
+    const zodSchema = import_lazy_zod3.z.fromJSONSchema(
       jsonSchema,
       {
         defaultTarget: "draft-2020-12"
       }
     );
     if (typeof zodSchema?.parse !== "function") {
-      return { schema: import_lazy_zod2.z.looseObject({}), failed: true };
+      return { schema: import_lazy_zod3.z.looseObject({}), failed: true };
     }
     return { schema: zodSchema, failed: false };
   } catch {
-    return { schema: import_lazy_zod2.z.looseObject({}), failed: true };
+    return { schema: import_lazy_zod3.z.looseObject({}), failed: true };
   }
 }
 function getCompiledOpSchemas(args) {
@@ -802,345 +1080,7 @@ function getCompiledOpSchemas(args) {
   return value;
 }
 
-// plugins/plugin-skilled-openapi/src/tools/execute-action.schema.ts
-var import_lazy_zod3 = require("@frontmcp/lazy-zod");
-var executeActionDescription = `Execute one action of a previously loaded skill.
-
-Pipeline:
-  1. Resolve (skillId, actionId) \u2192 bundled OpenAPI operation
-  2. Authorize: caller's authInfo is checked against the action's required authorities (if any)
-  3. Validate: the input is validated against the action's inputJsonSchema by the underlying executor
-  4. Outbound: an HTTPS request is built and sent to the service the action belongs to,
-     with credentials injected from the configured vault (never echoed back to you)
-  5. Response: the response body is validated against outputJsonSchema and returned in
-     a structured envelope. Failures (auth, schema, network) are returned as ok:false
-     with a structured error string \u2014 they DO NOT throw.
-
-INPUT: { skillId, actionId, input }
-OUTPUT: { ok, status, data?, contentType?, error? }`;
-var executeActionInputSchema = {
-  skillId: import_lazy_zod3.z.string().min(1).max(256).describe("Skill that owns the action"),
-  actionId: import_lazy_zod3.z.string().min(1).max(256).describe("Action id (operationId) within the skill"),
-  input: import_lazy_zod3.z.record(import_lazy_zod3.z.string(), import_lazy_zod3.z.unknown()).optional().describe("Flat input object; keys correspond to the action inputJsonSchema properties")
-};
-var executeActionOutputSchema = {
-  ok: import_lazy_zod3.z.boolean(),
-  status: import_lazy_zod3.z.number().int(),
-  data: import_lazy_zod3.z.unknown().optional(),
-  contentType: import_lazy_zod3.z.string().optional(),
-  error: import_lazy_zod3.z.string().optional()
-};
-
-// plugins/plugin-skilled-openapi/src/tools/execute-action.tool.ts
-var ExecuteActionTool = class extends import_sdk.ToolContext {
-  async execute(input) {
-    this.get(BundleSyncService);
-    const config = this.get(SkilledOpenApiConfig);
-    const hiddenOps = this.get(HiddenOpRegistry);
-    const bundleStore = this.get(import_skills4.BundleStore);
-    const guard = this.get(AuthorityGuard);
-    const resolver = this.get(SkilledOpenApiCredentialResolver);
-    const auditWriter = this.tryGet(import_skills4.SkillAuditWriterToken);
-    const auditSubject = this.authInfo?.user?.sub ?? "anonymous";
-    const detachAudit = (op, phase) => {
-      op.catch((error) => {
-        this.logger.warn(
-          `[skill-audit] detached ${phase} write failed: ${error instanceof Error ? error.message : String(error)}`
-        );
-      });
-    };
-    const TOTAL_STEPS = 5;
-    const tick = (step, message) => this.progress(step, TOTAL_STEPS, message);
-    const TELEMETRY_ACCESSOR_TOKEN = /* @__PURE__ */ Symbol.for("frontmcp:observability:telemetry-accessor");
-    const tel = this.tryGet(TELEMETRY_ACCESSOR_TOKEN);
-    const phaseEvent = (phase, attrs) => {
-      tel?.addEvent("skill_action.phase", {
-        phase,
-        skillId: input.skillId,
-        actionId: input.actionId,
-        ...attrs ?? {}
-      });
-    };
-    await tick(1, "resolve-action");
-    phaseEvent("resolve-action");
-    const entry = hiddenOps.get(input.skillId, input.actionId);
-    if (!entry) {
-      return {
-        ok: false,
-        status: 0,
-        error: `unknown action "${input.skillId}/${input.actionId}" \u2014 search_skill / load_skill first`
-      };
-    }
-    const pinned = entry;
-    const bundleId = pinned.bundleId;
-    const bundle = bundleStore.current();
-    await tick(2, "authority-check");
-    phaseEvent("authority-check", { bundleVersion: pinned.bundleVersion });
-    const policy = pinned.op.requiredAuthorities;
-    const authResult = await guard.check({
-      policy,
-      authInfo: this.authInfo ?? {},
-      input: input.input ?? {}
-    });
-    if (!authResult.granted) {
-      if (auditWriter) {
-        detachAudit(
-          auditWriter.writeAuthorityFail(
-            {
-              subject: auditSubject,
-              skillId: input.skillId,
-              actionId: input.actionId,
-              bundleId,
-              bundleVersion: pinned.bundleVersion,
-              input: input.input ?? {}
-            },
-            { reason: authResult.deniedBy ?? "policy not satisfied" }
-          ),
-          "authority-check-fail"
-        );
-      }
-      return {
-        ok: false,
-        status: 0,
-        error: `authority denied: ${authResult.deniedBy ?? "policy not satisfied"}`
-      };
-    }
-    if (auditWriter) {
-      detachAudit(
-        auditWriter.writeAuthorityPass({
-          subject: auditSubject,
-          skillId: input.skillId,
-          actionId: input.actionId,
-          bundleId,
-          bundleVersion: pinned.bundleVersion,
-          input: input.input ?? {}
-        }),
-        "authority-check-pass"
-      );
-    }
-    const schemas = getCompiledOpSchemas({
-      bundleVersion: pinned.bundleVersion,
-      operationId: pinned.op.operationId,
-      inputSchema: pinned.op.inputSchema,
-      outputSchema: pinned.op.outputSchema
-    });
-    await tick(3, "input-validate");
-    phaseEvent("input-validate", { bundleVersion: pinned.bundleVersion });
-    const inputParse = schemas.input.safeParse(input.input ?? {});
-    if (!inputParse.success) {
-      return {
-        ok: false,
-        status: 0,
-        error: `input validation failed: ${formatZodIssues(inputParse.error.issues)}`
-      };
-    }
-    const allowedHosts = /* @__PURE__ */ new Set();
-    try {
-      allowedHosts.add(new URL(pinned.service.baseUrl).hostname.toLowerCase());
-    } catch {
-    }
-    if (bundle) {
-      for (const svc of bundle.services) {
-        try {
-          allowedHosts.add(new URL(svc.baseUrl).hostname.toLowerCase());
-        } catch {
-        }
-      }
-    }
-    const deps = {
-      outbound: config.outbound,
-      resolver: { resolve: (ref, opts) => resolver.resolve(ref, opts) },
-      allowedHosts,
-      logger: this.logger
-    };
-    await tick(4, "http-call");
-    phaseEvent("http-call", { bundleVersion: pinned.bundleVersion });
-    let result;
-    try {
-      result = await executeOperation({
-        entry: pinned,
-        bundleId,
-        input: inputParse.data,
-        deps
-      });
-    } catch (e) {
-      if (auditWriter) {
-        detachAudit(
-          auditWriter.writeHttpCallFailure(
-            {
-              subject: auditSubject,
-              skillId: input.skillId,
-              actionId: input.actionId,
-              bundleId,
-              bundleVersion: pinned.bundleVersion,
-              input: input.input ?? {}
-            },
-            { status: 0, error: e }
-          ),
-          "http-call-failure"
-        );
-      }
-      throw e;
-    }
-    if (auditWriter) {
-      const auditCtx = {
-        subject: auditSubject,
-        skillId: input.skillId,
-        actionId: input.actionId,
-        bundleId,
-        bundleVersion: pinned.bundleVersion,
-        input: input.input ?? {}
-      };
-      if (result.ok) {
-        detachAudit(
-          auditWriter.writeHttpCallSuccess(auditCtx, {
-            status: result.status,
-            output: result.data ?? null
-          }),
-          "http-call-success"
-        );
-      } else {
-        detachAudit(
-          auditWriter.writeHttpCallFailure(auditCtx, {
-            status: result.status,
-            error: result.error ?? `http call failed with status ${result.status}`
-          }),
-          "http-call-failure"
-        );
-      }
-    }
-    const isJsonResponse = (result.contentType ?? "").toLowerCase().includes("application/json");
-    if (result.ok && isJsonResponse && result.data !== void 0 && result.data !== null) {
-      const outputParse = schemas.output.safeParse(result.data);
-      if (!outputParse.success) {
-        return {
-          ok: false,
-          status: result.status,
-          ...result.contentType ? { contentType: result.contentType } : {},
-          error: `upstream response failed output schema: ${formatZodIssues(outputParse.error.issues)}`
-        };
-      }
-    }
-    await tick(5, "done");
-    phaseEvent("done", { bundleVersion: pinned.bundleVersion });
-    tel?.setAttributes({
-      "skill_action.status": result.status,
-      "skill_action.ok": result.ok,
-      "skill_action.skill_id": input.skillId,
-      "skill_action.action_id": input.actionId,
-      "skill_action.bundle_version": pinned.bundleVersion
-    });
-    return {
-      ok: result.ok,
-      status: result.status,
-      ...result.data !== void 0 && result.data !== null ? { data: result.data } : {},
-      ...result.contentType ? { contentType: result.contentType } : {},
-      ...result.error ? { error: result.error } : {}
-    };
-  }
-};
-ExecuteActionTool = __decorateClass([
-  (0, import_sdk.Tool)({
-    name: "execute_action",
-    description: executeActionDescription,
-    inputSchema: executeActionInputSchema,
-    outputSchema: executeActionOutputSchema,
-    annotations: {
-      readOnlyHint: false,
-      destructiveHint: true,
-      openWorldHint: true
-    }
-  })
-], ExecuteActionTool);
-function formatZodIssues(issues) {
-  if (!issues.length) return "unspecified validation error";
-  return issues.slice(0, 3).map((i) => `${i.path.join(".") || "<root>"}: ${i.message}`).join("; ");
-}
-
-// plugins/plugin-skilled-openapi/src/tools/load-skill.tool.ts
-var import_sdk2 = require("@frontmcp/sdk");
-
-// plugins/plugin-skilled-openapi/src/tools/load-skill.schema.ts
-var import_lazy_zod4 = require("@frontmcp/lazy-zod");
-var loadSkillDescription = `Load the full instructions and executable actions for a specific skill.
-
-Use this AFTER \`search_skill\` once you've identified the right skill for the
-user's task. The returned object contains:
-  - \`instructions\`: markdown the LLM should read carefully before invoking
-  - \`actions\`: each action's input/output JSON Schema and required authorities
-  - \`bundleVersion\`: changes when the bundle is hot-swapped (use it to detect drift)
-
-INPUT: { skillId }
-OUTPUT: { skill: { id, name, description, instructions, actions[] }, isComplete }`;
-var loadSkillInputSchema = {
-  skillId: import_lazy_zod4.z.string().min(1).max(256).describe("Stable skill identifier (returned by search_skill)")
-};
-var loadSkillOutputSchema = {
-  skill: import_lazy_zod4.z.object({
-    id: import_lazy_zod4.z.string(),
-    name: import_lazy_zod4.z.string(),
-    description: import_lazy_zod4.z.string(),
-    instructions: import_lazy_zod4.z.string(),
-    bundleVersion: import_lazy_zod4.z.string().optional(),
-    actions: import_lazy_zod4.z.array(
-      import_lazy_zod4.z.object({
-        actionId: import_lazy_zod4.z.string(),
-        summary: import_lazy_zod4.z.string(),
-        description: import_lazy_zod4.z.string().optional(),
-        inputJsonSchema: import_lazy_zod4.z.record(import_lazy_zod4.z.string(), import_lazy_zod4.z.unknown()),
-        outputJsonSchema: import_lazy_zod4.z.record(import_lazy_zod4.z.string(), import_lazy_zod4.z.unknown()),
-        requiredAuthorities: import_lazy_zod4.z.record(import_lazy_zod4.z.string(), import_lazy_zod4.z.unknown()).optional()
-      })
-    ).optional()
-  }),
-  isComplete: import_lazy_zod4.z.boolean(),
-  warning: import_lazy_zod4.z.string().optional()
-};
-
-// plugins/plugin-skilled-openapi/src/tools/load-skill.tool.ts
-var LoadSkillTool = class extends import_sdk2.ToolContext {
-  async execute(input) {
-    this.get(BundleSyncService);
-    const scope = this.get(import_sdk2.ScopeEntry);
-    const skillRegistry = scope.skills;
-    if (!skillRegistry) {
-      throw new import_sdk2.InternalMcpError("SkillRegistry is not available on the active scope", "SKILL_REGISTRY_UNAVAILABLE");
-    }
-    const result = await skillRegistry.loadSkill(input.skillId);
-    if (!result) {
-      throw new import_sdk2.PublicMcpError(`Skill "${input.skillId}" not found`, "SKILL_NOT_FOUND", 404);
-    }
-    const skill = result.skill;
-    return {
-      skill: {
-        id: skill.id,
-        name: skill.name,
-        description: skill.description,
-        instructions: skill.instructions,
-        ...skill.bundleVersion !== void 0 && { bundleVersion: skill.bundleVersion },
-        ...skill.actions ? { actions: skill.actions } : {}
-      },
-      isComplete: result.isComplete,
-      ...result.warning !== void 0 && { warning: result.warning }
-    };
-  }
-};
-LoadSkillTool = __decorateClass([
-  (0, import_sdk2.Tool)({
-    name: "load_skill",
-    description: loadSkillDescription,
-    inputSchema: loadSkillInputSchema,
-    outputSchema: loadSkillOutputSchema,
-    annotations: {
-      readOnlyHint: true,
-      openWorldHint: false
-    }
-  })
-], LoadSkillTool);
-
 // plugins/plugin-skilled-openapi/src/tools/operation-tool.factory.ts
-var import_skills5 = require("@frontmcp/adapters/skills");
-var import_sdk3 = require("@frontmcp/sdk");
 var OPERATION_TOOL_OWNER_TOKEN = /* @__PURE__ */ Symbol.for("skilled-openapi:operation-tool-owner");
 var OPERATION_TOOL_OWNER = {
   kind: "plugin",
@@ -1177,6 +1117,7 @@ var OperationToolFactory = class {
   constructor(deps) {
     this.deps = deps;
   }
+  deps;
   /** Map (bundleId|opId) → the executor function that doubles as registry token. */
   registered = /* @__PURE__ */ new Map();
   /** Tool names this factory has pushed into the classification registry. */
@@ -1199,16 +1140,16 @@ var OperationToolFactory = class {
     const executor = this.makeExecutor(entry);
     const metadata = buildOperationMetadata(entry);
     const record = {
-      kind: import_sdk3.ToolKind.FUNCTION,
+      kind: import_sdk2.ToolKind.FUNCTION,
       provide: executor,
       metadata
     };
-    const instance = new import_sdk3.ToolInstance(record, this.deps.providers, OPERATION_TOOL_OWNER);
+    const instance = new import_sdk2.ToolInstance(record, this.deps.providers, OPERATION_TOOL_OWNER);
     this.deps.toolRegistry.registerToolInstance(instance);
     this.registered.set(key2, executor);
     if (this.deps.classificationRegistry && ctx?.pathsWithGet) {
       try {
-        const classification = (0, import_skills5.classifyOne)(
+        const classification = (0, import_skills4.classifyOne)(
           entry.bundleId,
           {
             operationId: entry.op.operationId,
@@ -1253,19 +1194,22 @@ var OperationToolFactory = class {
     return this.registered.size;
   }
   /**
-   * Build the actual function executor for one op. Mirrors `ExecuteActionTool.execute`:
+   * Build the actual function executor for one op. Mirrors the skill-action
+   * executor (`executeSkillAction`):
    * authority check + input validation + `executeOperation` — so callers
    * reaching the op via `callTool` get the same security gates as callers
-   * going through `execute_action`.
+   * going through `run_workflow`.
    */
   makeExecutor(entry) {
     return async (input, ctx) => {
       const config = ctx.get(SkilledOpenApiConfig);
       const guard = ctx.get(AuthorityGuard);
       const resolver = ctx.get(SkilledOpenApiCredentialResolver);
-      const policy = entry.op.requiredAuthorities;
       const authResult = await guard.check({
-        policy,
+        policy: entry.op.requiredAuthorities,
+        skillPolicy: entry.skillRequiredAuthorities,
+        isPublic: entry.op.public,
+        unprotectedOps: config.unprotectedOps,
         authInfo: ctx.authInfo ?? {},
         input: input ?? {}
       });
@@ -1318,6 +1262,233 @@ var OperationToolFactory = class {
   }
 };
 
+// plugins/plugin-skilled-openapi/src/tools/run-workflow.tool.ts
+var import_skills5 = require("@frontmcp/adapters/skills");
+var import_sdk3 = require("@frontmcp/sdk");
+
+// plugins/plugin-skilled-openapi/src/executor/execute-skill-action.ts
+function formatZodIssues(issues) {
+  if (!issues.length) return "unspecified validation error";
+  return issues.slice(0, 3).map((i) => `${i.path.join(".") || "<root>"}: ${i.message}`).join("; ");
+}
+async function executeSkillAction(args) {
+  const { entry, input, authInfo, deps } = args;
+  const { config, resolver, guard, logger, audit } = deps;
+  const auditCtx = {
+    subject: audit?.subject ?? "anonymous",
+    skillId: entry.skillId,
+    actionId: entry.op.operationId,
+    bundleId: entry.bundleId,
+    bundleVersion: entry.bundleVersion,
+    input: input ?? {}
+  };
+  const detach = (op, phase) => {
+    op?.catch((e) => logger.warn(`[skill-audit] ${phase} write failed: ${e instanceof Error ? e.message : String(e)}`));
+  };
+  const authResult = await guard.check({
+    policy: entry.op.requiredAuthorities,
+    skillPolicy: entry.skillRequiredAuthorities,
+    isPublic: entry.op.public,
+    unprotectedOps: config.unprotectedOps,
+    authInfo: authInfo ?? {},
+    input: input ?? {}
+  });
+  if (!authResult.granted) {
+    detach(
+      audit?.writer.writeAuthorityFail(auditCtx, { reason: authResult.deniedBy ?? "policy not satisfied" }),
+      "authority-fail"
+    );
+    return { ok: false, status: 0, error: `authority denied: ${authResult.deniedBy ?? "policy not satisfied"}` };
+  }
+  detach(audit?.writer.writeAuthorityPass(auditCtx), "authority-pass");
+  const schemas = getCompiledOpSchemas({
+    bundleVersion: entry.bundleVersion,
+    operationId: entry.op.operationId,
+    inputSchema: entry.op.inputSchema,
+    outputSchema: entry.op.outputSchema
+  });
+  const inputParse = schemas.input.safeParse(input ?? {});
+  if (!inputParse.success) {
+    return { ok: false, status: 0, error: `input validation failed: ${formatZodIssues(inputParse.error.issues)}` };
+  }
+  const allowedHosts = /* @__PURE__ */ new Set();
+  try {
+    allowedHosts.add(new URL(entry.service.baseUrl).hostname.toLowerCase());
+  } catch {
+  }
+  const runtimeDeps = {
+    outbound: config.outbound,
+    resolver: { resolve: (ref, opts) => resolver.resolve(ref, opts) },
+    allowedHosts,
+    logger
+  };
+  let result;
+  try {
+    result = await executeOperation({
+      entry,
+      bundleId: entry.bundleId,
+      input: inputParse.data,
+      deps: runtimeDeps
+    });
+  } catch (e) {
+    detach(audit?.writer.writeHttpCallFailure(auditCtx, { status: 0, error: e }), "http-call-failure");
+    throw e;
+  }
+  if (result.ok) {
+    detach(
+      audit?.writer.writeHttpCallSuccess(auditCtx, { status: result.status, output: result.data ?? null }),
+      "http-call-success"
+    );
+  } else {
+    detach(
+      audit?.writer.writeHttpCallFailure(auditCtx, {
+        status: result.status,
+        error: result.error ?? `http call failed with status ${result.status}`
+      }),
+      "http-call-failure"
+    );
+  }
+  const isJsonResponse = (result.contentType ?? "").toLowerCase().includes("application/json");
+  if (result.ok && isJsonResponse && result.data !== void 0 && result.data !== null) {
+    const outputParse = schemas.output.safeParse(result.data);
+    if (!outputParse.success) {
+      return {
+        ok: false,
+        status: result.status,
+        ...result.contentType ? { contentType: result.contentType } : {},
+        error: `upstream response failed output schema: ${formatZodIssues(outputParse.error.issues)}`
+      };
+    }
+  }
+  return {
+    ok: result.ok,
+    status: result.status,
+    ...result.data !== void 0 && result.data !== null ? { data: result.data } : {},
+    ...result.contentType ? { contentType: result.contentType } : {},
+    ...result.error ? { error: result.error } : {}
+  };
+}
+
+// plugins/plugin-skilled-openapi/src/tools/run-workflow.schema.ts
+var import_lazy_zod4 = require("@frontmcp/lazy-zod");
+var runWorkflowDescription = `Execute a task by running a short AgentScript program in a secure sandbox (enclave).
+
+This is the EXECUTE step of the skill mechanism. After \`search_skill\` (to find a
+skill) and \`load_skill\` (to read its instructions + the actions it offers), write
+a program that calls those actions to accomplish the user's task \u2014 chaining
+several calls in ONE round-trip, with each call authorized, schema-validated, and
+sent to the real upstream API (credentials injected from the vault, never echoed).
+
+Inside the script:
+  - \`await callTool(actionId, input)\` invokes a loaded skill's action (the
+    \`actionId\` is what \`load_skill\` lists under \`actions[]\`). It returns the
+    action's response \`data\`, or throws if the action is unknown / unauthorized /
+    fails validation.
+  - \`Math\` and \`JSON\` are available. There is NO host access and NO network
+    except through \`callTool\`.
+  - The script's final \`return <value>\` is the result.
+
+Example (after loading a skill exposing getTodo + getUser):
+  const t = await callTool("getTodo", { id: 1 });
+  const u = await callTool("getUser", { id: t.userId });
+  return { todo: t.title, owner: u.name };
+
+OUTPUT: { success, value?, error?, stats }`;
+var runWorkflowInputSchema = {
+  script: import_lazy_zod4.z.string().min(1).max(2e4).describe("AgentScript source. Use `await callTool(actionId, input)` for loaded skill actions; end with `return <value>`.")
+};
+var runWorkflowOutputSchema = {
+  success: import_lazy_zod4.z.boolean(),
+  value: import_lazy_zod4.z.unknown().optional(),
+  error: import_lazy_zod4.z.string().optional(),
+  stats: import_lazy_zod4.z.object({
+    durationMs: import_lazy_zod4.z.number(),
+    toolCalls: import_lazy_zod4.z.number(),
+    steps: import_lazy_zod4.z.number()
+  }).optional()
+};
+
+// plugins/plugin-skilled-openapi/src/tools/run-workflow.tool.ts
+var MAX_STEPS = 2e6;
+var MAX_TOOL_CALLS = 25;
+var TIMEOUT_MS = 8e3;
+var RunWorkflowTool = class extends import_sdk3.ToolContext {
+  async execute(input) {
+    this.get(BundleSyncService);
+    const config = this.get(SkilledOpenApiConfig);
+    const hiddenOps = this.get(HiddenOpRegistry);
+    const guard = this.get(AuthorityGuard);
+    const resolver = this.get(SkilledOpenApiCredentialResolver);
+    let transformAgentScript;
+    let InterpreterAdapter;
+    try {
+      ({ transformAgentScript } = await import("@enclave-vm/ast"));
+      ({ InterpreterAdapter } = await import("@enclave-vm/core/worker"));
+    } catch {
+      return {
+        success: false,
+        error: "workflow execution unavailable: the @enclave-vm sandbox is not installed. Install @enclave-vm/core and @enclave-vm/ast to enable run_workflow."
+      };
+    }
+    const auditWriter = this.tryGet(import_skills5.SkillAuditWriterToken);
+    const deps = {
+      config: { outbound: config.outbound, unprotectedOps: config.unprotectedOps },
+      resolver: { resolve: (ref, opts) => resolver.resolve(ref, opts) },
+      guard,
+      logger: this.logger,
+      ...auditWriter ? { audit: { writer: auditWriter, subject: this.authInfo?.user?.sub ?? "anonymous" } } : {}
+    };
+    const toolHandler = async (actionId, actionInput) => {
+      const entry = hiddenOps.getByActionId(actionId);
+      if (!entry) {
+        throw new Error(`unknown action "${actionId}" \u2014 run search_skill then load_skill to discover available actions`);
+      }
+      const res = await executeSkillAction({ entry, input: actionInput ?? {}, authInfo: this.authInfo, deps });
+      if (!res.ok) {
+        throw new Error(res.error ?? `action "${actionId}" failed with status ${res.status}`);
+      }
+      return res.data;
+    };
+    let transformed;
+    try {
+      transformed = transformAgentScript(input.script, { transformLoops: false });
+    } catch (error) {
+      return { success: false, error: `AgentScript rejected: ${error instanceof Error ? error.message : String(error)}` };
+    }
+    const adapter = new InterpreterAdapter({ maxSteps: MAX_STEPS });
+    const context = {
+      config: { maxToolCalls: MAX_TOOL_CALLS, timeout: TIMEOUT_MS },
+      stats: { duration: 0, toolCallCount: 0, iterationCount: 0, startTime: 0 },
+      abortController: new AbortController(),
+      aborted: false,
+      toolHandler
+    };
+    const result = await adapter.execute(transformed, context);
+    const stats = {
+      durationMs: result.stats.duration,
+      toolCalls: result.stats.toolCallCount,
+      steps: result.stats.iterationCount
+    };
+    if (!result.success) {
+      return { success: false, error: result.error?.message ?? "workflow failed", stats };
+    }
+    return { success: true, value: result.value, stats };
+  }
+};
+RunWorkflowTool = __decorateClass([
+  (0, import_sdk3.Tool)({
+    name: "run_workflow",
+    description: runWorkflowDescription,
+    inputSchema: runWorkflowInputSchema,
+    outputSchema: runWorkflowOutputSchema,
+    annotations: {
+      readOnlyHint: false,
+      destructiveHint: true,
+      openWorldHint: true
+    }
+  })
+], RunWorkflowTool);
+
 // plugins/plugin-skilled-openapi/src/tools/search-skill.tool.ts
 var import_sdk4 = require("@frontmcp/sdk");
 
@@ -1329,19 +1500,25 @@ A "skill" is a curated bundle of REST operations exposed to you behind a single
 named capability \u2014 instead of seeing each individual API endpoint, you see one
 skill that knows how to do something useful (e.g. "billing", "customers"). Use
 this tool first to discover what skills exist for the user's request, then call
-\`load_skill\` to read its instructions + the actions it offers, and \`execute_action\`
-to actually invoke one.
+\`load_skill\` to read its instructions + the actions it offers, and \`run_workflow\`
+to execute \u2014 a short sandboxed script that calls the skill's actions via
+\`callTool(actionId, input)\` (chaining several in one round-trip).
 
 INPUT:
 - query: short natural-language description of what you want to do
 - limit?: max results (default 20, max 50)
 - tags?: filter to skills carrying these tags
+- notQuery?: anti-query \u2014 describe what you do NOT want; matching skills are
+  demoted (e.g. query "rate limiting", notQuery "enforcement" to prefer guidance
+  over enforcement skills)
 
 OUTPUT: { skills: Array<{ skillId, name, description, score }> }`;
 var searchSkillInputSchema = {
   query: import_lazy_zod5.z.string().min(1).max(2048).describe("Natural-language search query"),
   limit: import_lazy_zod5.z.number().int().positive().max(50).optional().describe("Max results (default 20)"),
-  tags: import_lazy_zod5.z.array(import_lazy_zod5.z.string().min(1).max(64)).max(16).optional().describe("Filter by tags")
+  tags: import_lazy_zod5.z.array(import_lazy_zod5.z.string().min(1).max(64)).max(16).optional().describe("Filter by tags"),
+  notQuery: import_lazy_zod5.z.union([import_lazy_zod5.z.string().min(1).max(2048), import_lazy_zod5.z.array(import_lazy_zod5.z.string().min(1).max(2048)).max(8)]).optional().describe("Anti-query: skills matching this are demoted in ranking"),
+  notWeight: import_lazy_zod5.z.number().positive().max(10).optional().describe("Strength of the anti-query demotion (default 1)")
 };
 var searchSkillOutputSchema = {
   skills: import_lazy_zod5.z.array(
@@ -1368,7 +1545,11 @@ var SearchSkillTool = class extends import_sdk4.ToolContext {
     const tags = input.tags;
     const results = await skillRegistry.search(input.query, {
       topK: limit,
-      ...tags ? { tags } : {}
+      ...tags ? { tags } : {},
+      // Anti-query demotion (honored when the skill index supports it) — surfaces
+      // what the user wants while pushing down what they explicitly do not.
+      ...input.notQuery !== void 0 ? { negativeQuery: input.notQuery } : {},
+      ...input.notWeight !== void 0 ? { negativeWeight: input.notWeight } : {}
     });
     return {
       skills: results.map((r) => ({
@@ -1396,6 +1577,17 @@ SearchSkillTool = __decorateClass([
 
 // plugins/plugin-skilled-openapi/src/skilled-openapi.plugin.ts
 var TELEMETRY_FACTORY_TOKEN = /* @__PURE__ */ Symbol.for("frontmcp:observability:telemetry-factory");
+var SKILLED_OPENAPI_RUNTIME_DEPS_TOKEN = /* @__PURE__ */ Symbol.for("frontmcp:skilled-openapi:runtime-deps");
+function resolveRuntimeDeps(scope) {
+  const providers = scope?.providers;
+  if (!providers || typeof providers.get !== "function") return void 0;
+  try {
+    const deps = providers.get(SKILLED_OPENAPI_RUNTIME_DEPS_TOKEN);
+    return deps && typeof deps === "object" ? deps : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function resolveBundleTelemetry(scope) {
   const providers = scope?.providers;
   if (!providers || typeof providers.get !== "function") return void 0;
@@ -1425,6 +1617,24 @@ var SkilledOpenApiPlugin = class extends import_sdk5.DynamicPlugin {
     }
     return this.cachedLogger;
   }
+  async injectSkillCatalogIntoSearchTool(flowCtx) {
+    const { tools } = flowCtx.state;
+    if (!tools || tools.length === 0) return;
+    const target = tools.find((item) => item.tool?.metadata?.name === "search_skill");
+    if (!target) return;
+    try {
+      this.get(BundleSyncService);
+    } catch {
+    }
+    const scope = this.get(import_sdk5.ScopeEntry);
+    const catalog = (0, import_sdk5.buildSkillsCatalogSummary)(scope.skills);
+    const description = catalog ? `${searchSkillDescription}
+
+---
+
+${catalog}` : searchSkillDescription;
+    target.tool.metadata.description = description;
+  }
   warnIfInsecureConfig() {
     if (this.options.dev) {
       console.warn(
@@ -1524,13 +1734,21 @@ var SkilledOpenApiPlugin = class extends import_sdk5.DynamicPlugin {
             logger,
             opToolFactory
           );
+          const runtimeDeps = resolveRuntimeDeps(scope);
           let source;
           try {
-            source = (0, import_skills6.createBundleSource)(parsed.source, parsed.bundleCacheDir, logger);
+            source = (0, import_skills6.createBundleSource)(parsed.source, parsed.bundleCacheDir, logger, runtimeDeps);
           } catch (e) {
             logger.error(`failed to construct bundle source: ${e.message}`);
             return sync;
           }
+          if (runtimeDeps?.attach) {
+            try {
+              runtimeDeps.attach(source);
+            } catch (e) {
+              logger.warn(`runtime-deps attach threw: ${e.message}`);
+            }
+          }
           source.onChange((bundle) => {
             void sync.apply(bundle).then((result) => {
               if (!result.applied) {
@@ -1552,12 +1770,15 @@ var SkilledOpenApiPlugin = class extends import_sdk5.DynamicPlugin {
     ];
   }
 };
+__decorateClass([
+  import_sdk5.ListToolsHook.Did("findTools", { priority: 50 })
+], SkilledOpenApiPlugin.prototype, "injectSkillCatalogIntoSearchTool", 1);
 SkilledOpenApiPlugin = __decorateClass([
   (0, import_sdk5.Plugin)({
     name: "skilled-openapi",
     description: "Serve a customer's OpenAPI spec as signed skill bundles with hidden per-operation tools mediated by 3 meta-tools.",
     providers: [],
-    tools: [SearchSkillTool, LoadSkillTool, ExecuteActionTool]
+    tools: [SearchSkillTool, LoadSkillTool, RunWorkflowTool]
   })
 ], SkilledOpenApiPlugin);
 
@@ -1565,6 +1786,7 @@ SkilledOpenApiPlugin = __decorateClass([
 var index_default = SkilledOpenApiPlugin;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  SKILLED_OPENAPI_RUNTIME_DEPS_TOKEN,
   SkilledOpenApiConfig,
   SkilledOpenApiCredentialResolver,
   SkilledOpenApiPlugin,