@iowarp/clio-coder 0.4.6 → 0.4.8

package/src/tools/context/surface.ts

@@ -6,23 +6,37 @@ import type { ToolSurface } from "../lazy-tool.js";
 export const contextToolSurface = {
 	name: ToolNames.Context,
 	description:
-		"Environment context: scope=workspace returns the git/project snapshot, scope=docs searches Clio's bundled documentation (omit query to list the corpus), scope=skills lists installed and marketplace skills or loads an installed one by name, scope=recall returns an exact persisted evicted or summarized tool result by ref; omit ref to discover historical results by query with bounded limit/offset pages. For repository code and the repo's generated wiki use code_nav (mode=wiki).",
+		"Environment context: scope=workspace returns the git/project snapshot, scope=docs searches Clio's bundled documentation (omit query to list the corpus), scope=skills lists installed and marketplace skills or loads an installed one by name, scope=library reads the recipe catalog (installed skills/agents/prompts/fleets with their owner and invocation, plus installable packages) without activating or installing anything, scope=recall returns an exact persisted evicted or summarized tool result by ref; omit ref to discover historical results by query with bounded limit/offset pages. For repository code and the repo's generated wiki use code_nav (mode=wiki).",
 	parameters: Type.Object({
-		scope: StringEnum(["workspace", "docs", "skills", "recall"], { description: "Context source." }),
+		scope: StringEnum(["workspace", "docs", "skills", "library", "recall"], { description: "Context source." }),
 		query: Type.Optional(
 			Type.String({
-				description: "scope=docs: question or terms. scope=recall without ref: path, tool, or ref terms; omit to list.",
+				description:
+					"scope=docs: question or terms. scope=library: name, owner, or description terms. scope=recall without ref: path, tool, or ref terms; omit to list.",
 			}),
 		),
 		name: Type.Optional(Type.String({ description: "scope=skills: skill name to load; omit to list." })),
+		kind: Type.Optional(
+			StringEnum(["skill", "agent", "prompt", "fleet", "plugin"], {
+				description: "scope=library: one recipe kind, or plugin for installable package rows.",
+			}),
+		),
 		limit: Type.Optional(
 			Type.Number({
-				description: "scope=docs: max sections (default 5, max 12). scope=recall: max refs (default 8, max 12).",
+				description:
+					"scope=docs: max sections (default 5, max 12). scope=library: max rows (default 20, max 50). scope=recall: max refs (default 8, max 12).",
+			}),
+		),
+		ref: Type.Optional(
+			Type.String({
+				description:
+					"scope=library: exact kind:name or resource key for one record. scope=recall: exact persisted result ref; omit for discovery.",
 			}),
 		),
-		ref: Type.Optional(Type.String({ description: "scope=recall: exact persisted result ref; omit for discovery." })),
 		offset: Type.Optional(
-			Type.Number({ description: "scope=recall discovery: zero-based offset; follow nextOffset (default 0)." }),
+			Type.Number({
+				description: "scope=library and scope=recall discovery: zero-based offset; follow nextOffset (default 0).",
+			}),
 		),
 		include_tree: Type.Optional(Type.Boolean({ description: "scope=skills: list files under the skill base_dir." })),
 	}),

package/src/tools/core-bootstrap.ts

@@ -1,4 +1,5 @@
 import type { ContextRecalledPayload } from "../core/bus-events.js";
+import type { WorkerRecall } from "../domains/context/worker/recall.js";
 import type { LoadSkillsInput } from "../domains/resources/index.js";
 import type { SessionContract } from "../domains/session/contract.js";
 import type { DecisionBoardStore } from "../domains/session/decision-board.js";
@@ -33,6 +34,7 @@ import { webFetchToolSurface } from "./web-fetch-surface.js";
 import { writeTool } from "./write.js";
 
 export interface CoreToolBootstrapDeps {
+	workerRecall?: WorkerRecall;
 	session?: SessionContract;
 	/** Full ledger of the current session; context(scope=recall) folds it. Absent in worker registries. */
 	readSessionEntries?: () => ReadonlyArray<SessionEntry>;
@@ -117,6 +119,7 @@ export function registerCoreTools(registry: ToolRegistry, deps: CoreToolBootstra
 		),
 	});
 	const skillToolDeps = {
+		...(deps.workerRecall ? { workerRecall: deps.workerRecall } : {}),
 		getCwd: () => deps.session?.current()?.cwd ?? process.cwd(),
 		...(deps.getSkillLoaderOptions ? { getSkillLoaderOptions: deps.getSkillLoaderOptions } : {}),
 		...(deps.skillMarketplace !== undefined ? { skillMarketplace: deps.skillMarketplace } : {}),

package/src/tools/dispatch-admission.ts

@@ -1,4 +1,5 @@
 import { isAbsolute, relative, resolve } from "node:path";
+import { selectWorkerContext } from "../domains/context/worker/select.js";
 import type { DispatchPlanTaskResolution, DispatchRequest } from "../domains/dispatch/contract.js";
 import type { ExecutionPlan } from "../domains/dispatch/execution-plan.js";
 import { gateDeciderAgentId } from "../domains/dispatch/execution-role.js";
@@ -344,6 +345,8 @@ export function createDispatchAdmissionController(deps: DispatchToolDeps): Dispa
 			agent: resolution.agentId,
 			task: request.task,
 			...(request.briefing !== undefined ? { briefing: request.briefing } : {}),
+			...(request.context ? { context: structuredClone(request.context) } : {}),
+			...(request.contextSeed ? { workerContext: structuredClone(request.contextSeed.provenance) } : {}),
 			...(request.worktree === true
 				? {
 						worktree: true as const,
@@ -510,6 +513,26 @@ export function createDispatchAdmissionController(deps: DispatchToolDeps): Dispa
 		}
 		const parsed = parseRequests(args);
 		if (!parsed.ok) return shapeRejection(args, parsed.message);
+		try {
+			const inheriting = parsed.requests.filter((request) => request.context && request.context.mode !== "isolated");
+			if (inheriting.length > 0) {
+				const source = deps.captureWorkerContext?.();
+				if (!source) throw new Error("worker context: no active parent conversation is available");
+				for (const request of inheriting) {
+					const policy = request.context;
+					if (!policy || policy.mode === "isolated") continue;
+					request.contextSeed = selectWorkerContext(
+						source,
+						policy,
+						request.intent
+							? [...request.intent.readRoots, ...request.intent.relevantPaths, ...request.intent.writeRoots]
+							: [],
+					);
+				}
+			}
+		} catch (error) {
+			return preparationFailure(args, error);
+		}
 		if (
 			args.mode !== undefined &&
 			!["parallel", "sequential", "pipeline", "compete", "council"].includes(String(args.mode))
@@ -755,7 +778,7 @@ export function createDispatchAdmissionController(deps: DispatchToolDeps): Dispa
 				topology === "compete" ||
 				tasks.some((task) => task.node !== "local" || task.failover === "approved");
 			if (!planScale) {
-				const marked = parsed.requests.some((request) => request.intent !== undefined)
+				const marked = parsed.requests.some((request) => request.intent !== undefined || request.contextSeed !== undefined)
 					? markPrepared(
 							withResolvedDispatchPlan(args, {
 								version: 3,

package/src/tools/dispatch-arguments.ts

@@ -1,3 +1,4 @@
+import { parseWorkerContextPolicy } from "../domains/context/worker/contract.js";
 /** Pure model-argument parsing; every returned DispatchRequest has a concrete agent id. */
 
 import { parseResultSummaryMaxBytes } from "../domains/agents/result-contract.js";
@@ -168,6 +169,13 @@ function dispatchRequestFromArgs(
 				}
 			: {}),
 	};
+	if (args.context !== undefined) {
+		try {
+			request.context = parseWorkerContextPolicy(args.context);
+		} catch (error) {
+			return { ok: false, message: error instanceof Error ? error.message : String(error) };
+		}
+	}
 	if ("briefing" in args && args.briefing !== undefined) {
 		if (typeof args.briefing !== "string") return { ok: false, message: "briefing must be a string" };
 		const briefing = args.briefing.trim();

package/src/tools/dispatch-plan.ts

@@ -1,3 +1,9 @@
+import {
+	parseWorkerContextPolicy,
+	type WorkerContextPolicy,
+	type WorkerContextProvenance,
+} from "../domains/context/worker/contract.js";
+import { parseWorkerContextProvenance } from "../worker/context-seed.js";
 /**
  * Plan-scale dispatch detection and the operator-facing plan artifact.
  *
@@ -61,6 +67,8 @@ export interface DispatchPlanTaskView {
 	task: string;
 	/** Exact canonical bounded briefing approved for this task. */
 	briefing?: string;
+	context?: WorkerContextPolicy;
+	workerContext?: WorkerContextProvenance;
 	worktree?: true;
 	apply?: "merge" | "preserve";
 	worktreeDestination?: string;
@@ -138,6 +146,8 @@ export interface ResolvedDispatchPlanArtifact {
 			Pick<
 				DispatchPlanTaskView,
 				| "briefing"
+				| "context"
+				| "workerContext"
 				| "worktree"
 				| "apply"
 				| "worktreeDestination"
@@ -175,8 +185,12 @@ export function withResolvedPlanTaskPin(
 	options: { pinTask?: boolean; pinBriefing?: boolean } = {},
 ): DispatchRequest {
 	if (task === undefined) return request;
+	if (task.workerContext !== undefined && request.contextSeed?.provenance.contentHash !== task.workerContext.contentHash)
+		throw new Error("worker context: admitted seed no longer matches the plan");
 	const {
 		briefing: _briefing,
+		context: _context,
+		contextSeed: _contextSeed,
 		failover: _failover,
 		allowedCandidates: _candidates,
 		agentSelection: _agentSelection,
@@ -188,6 +202,8 @@ export function withResolvedPlanTaskPin(
 	return {
 		...base,
 		agentId: task.agent,
+		...(task.context ? { context: structuredClone(task.context) } : {}),
+		...(task.workerContext && request.contextSeed ? { contextSeed: structuredClone(request.contextSeed) } : {}),
 		executionRole: task.executionRole,
 		...(request.reservation !== undefined &&
 		(task.stepId !== null || (task.role !== undefined && task.position !== undefined))
@@ -476,6 +492,10 @@ function renderPlanText(
 			if (agentReasons !== undefined && agentReasons.length > 0)
 				lines.push(`    agent-exclusions=${agentReasons.join(";")}`);
 		}
+		if (task.context !== undefined)
+			lines.push(
+				`    context=${task.context.mode}${task.workerContext ? ` tokens=${task.workerContext.estimatedTokens} omitted=${task.workerContext.omittedMessages} sha256=${task.workerContext.contentHash}` : ""}`,
+			);
 		if (task.briefing !== undefined) {
 			lines.push(
 				`    briefing_bytes=${Buffer.byteLength(task.briefing, "utf8")} briefing_sha256=${createHash("sha256").update(task.briefing, "utf8").digest("hex")} briefing_preview=${JSON.stringify(safeField(task.briefing, false))}`,
@@ -497,10 +517,20 @@ function renderPlanText(
 
 function isResolvedTask(value: unknown): value is ResolvedDispatchPlanArtifact["tasks"][number] {
 	if (!isRecord(value)) return false;
+	try {
+		const context = value.context === undefined ? undefined : parseWorkerContextPolicy(value.context);
+		const provenance = value.workerContext === undefined ? undefined : parseWorkerContextProvenance(value.workerContext);
+		if (provenance && provenance.mode !== context?.mode) return false;
+		if (context && context.mode !== "isolated" && !provenance) return false;
+	} catch {
+		return false;
+	}
 	const allowedKeys = new Set([
 		"agent",
 		"task",
 		"briefing",
+		"context",
+		"workerContext",
 		"worktree",
 		"apply",
 		"worktreeDestination",
@@ -821,6 +851,8 @@ export function resolvedDispatchPlanFromArgs(args: Record<string, unknown>): Res
 			agent: task.agent.trim(),
 			task: task.task.trim(),
 			...(task.briefing !== undefined ? { briefing: task.briefing.trim() } : {}),
+			...(task.context !== undefined ? { context: parseWorkerContextPolicy(task.context) } : {}),
+			...(task.workerContext !== undefined ? { workerContext: structuredClone(task.workerContext) } : {}),
 			...(task.worktree === true
 				? {
 						worktree: true as const,

package/src/tools/dispatch-schema.ts

@@ -1,6 +1,7 @@
 import { type Static, Type } from "typebox";
 import type { FleetSettings } from "../core/defaults.js";
 import { RESULT_SUMMARY_MAX_BYTES_CEILING } from "../domains/agents/result-contract.js";
+import { WORKER_CONTEXT_SPLICE_TOKENS } from "../domains/context/worker/contract.js";
 import { DISPATCH_BRIEFING_MAX_BYTES } from "../domains/dispatch/validation.js";
 import { StringEnum } from "../engine/ai.js";
 import { TOOL_PROFILE_NAMES } from "./profiles.js";
@@ -116,7 +117,6 @@ const DispatchIntentSchema = Type.Object(
 	},
 );
 
-const DISPATCH_DEFS = { intent: DispatchIntentSchema, budget: DispatchBudgetSchema };
 const IntentRef = Type.Unsafe<Static<typeof DispatchIntentSchema>>({ $ref: "#/$defs/intent" });
 const BudgetRef = Type.Unsafe<Static<typeof DispatchBudgetSchema>>({ $ref: "#/$defs/budget" });
 
@@ -136,6 +136,34 @@ const MODE_DESCRIPTION: Record<"full" | "noCouncil" | "noCompete" | "neither", s
  * Optional blocks come and go with `composition`, and the `mode` enum only
  * names the modes whose fields are advertised.
  */
+const WorkerContextSchema = Type.Union(
+	[
+		Type.Object({ mode: Type.Literal("isolated") }, { additionalProperties: false }),
+		Type.Object(
+			{ mode: Type.Literal("fork"), max_tokens: Type.Optional(Type.Integer({ minimum: 256, maximum: 262144 })) },
+			{ additionalProperties: false },
+		),
+		Type.Object(
+			{
+				mode: Type.Literal("splice"),
+				max_tokens: Type.Optional(Type.Integer({ minimum: 256, maximum: 262144 })),
+				paths: Type.Optional(Type.Array(Type.String({ minLength: 1, maxLength: 4096 }), { minItems: 1, maxItems: 64 })),
+				refs: Type.Optional(Type.Array(Type.String({ minLength: 1, maxLength: 4096 }), { minItems: 1, maxItems: 64 })),
+			},
+			{ additionalProperties: false },
+		),
+	],
+	{
+		description: `Parent conversation: isolated (default), fork (native history; never silently truncated), or splice (selected text evidence, default ${WORKER_CONTEXT_SPLICE_TOKENS} tokens). refs: tool:<call-id> or message:<index> in the current snapshot. Batch defaults may be overridden per task.`,
+	},
+);
+const ContextRef = Type.Unsafe<Static<typeof WorkerContextSchema>>({ $ref: "#/$defs/workerContext" });
+const DISPATCH_DEFS = {
+	intent: DispatchIntentSchema,
+	budget: DispatchBudgetSchema,
+	workerContext: WorkerContextSchema,
+};
+
 export function buildDispatchParameters(composition: DispatchSchemaComposition = FULL_DISPATCH_SCHEMA_COMPOSITION) {
 	const modes = [
 		"parallel",
@@ -178,6 +206,7 @@ export function buildDispatchParameters(composition: DispatchSchemaComposition =
 						// tokens advertising them twice).
 						Type.Object({
 							task: Type.String({ description: "The assignment, with expected output and constraints." }),
+							context: Type.Optional(ContextRef),
 							briefing: Type.Optional(
 								Type.String({ description: `Per-task parent context, max ${DISPATCH_BRIEFING_MAX_BYTES} UTF-8 bytes.` }),
 							),
@@ -288,6 +317,7 @@ export function buildDispatchParameters(composition: DispatchSchemaComposition =
 						: "Default recipe id for tasks without their own agent, or auto (default coder).",
 				}),
 			),
+			context: Type.Optional(ContextRef),
 			briefing: Type.Optional(
 				Type.String({
 					description: `Parent context for task, or the shared default for tasks; never instructions. Max ${DISPATCH_BRIEFING_MAX_BYTES} UTF-8 bytes.`,

package/src/tools/dispatch-types.ts

@@ -1,5 +1,6 @@
 import type { SafeEventBus } from "../core/event-bus.js";
 import type { AgentSpec } from "../domains/agents/spec.js";
+import type { WorkerContextSnapshot } from "../domains/context/worker/contract.js";
 import type { DispatchContract, DispatchRequest } from "../domains/dispatch/contract.js";
 import type { AgentRoleFactsResolver } from "../domains/dispatch/execution-role.js";
 import type { AutonomyLevel } from "../domains/safety/autonomy.js";
@@ -83,6 +84,8 @@ export type DispatchExecutionSnapshot =
 	| DispatchListExecutionSnapshot;
 
 export interface DispatchToolDeps {
+	/** Synchronous read of the active model-visible history, before admission can park. */
+	captureWorkerContext?: () => WorkerContextSnapshot | null;
 	dispatch: DispatchContract;
 	bus?: SafeEventBus;
 	/** Instance-scoped owner for ordinary tool-owned run streams and monitor tails. */

package/src/tools/dispatch.ts

@@ -61,7 +61,7 @@ export function createDispatchTool(
 		// Delegation prompt sections. This description says only what the call
 		// shape is; every field below carries one discriminating sentence.
 		description:
-			"Delegate to a fleet worker: task dispatches one assignment, tasks dispatches a batch, never both. briefing is bounded parent context, never instructions. A call auto-waits for the sealed receipt; detach:true returns run ids to monitor and collect later. Declare intent on every dispatch. list:true shows the roster.",
+			"Delegate to a fleet worker: task dispatches one assignment, tasks dispatches a batch, never both. context selects isolated (default), fork (native only), or splice inheritance. briefing adds bounded parent evidence. A call auto-waits for the sealed receipt; detach:true returns run ids to monitor and collect later. Declare intent on every dispatch. list:true shows the roster.",
 		// Composed once per session: council, compete, and adaptive-routing fields
 		// are advertised only when the fleet can exercise them (see dispatch-schema.ts).
 		parameters: buildDispatchParameters(deps.getSchemaComposition?.() ?? FULL_DISPATCH_SCHEMA_COMPOSITION),

package/src/tools/harness-extensions.ts

@@ -0,0 +1,169 @@
+import path from "node:path";
+import type { TSchema } from "typebox";
+import { Value } from "typebox/value";
+import { parse as parseYaml } from "yaml";
+import { runCommandVector } from "../core/safe-exec.js";
+import type { DynamicToolName } from "../core/tool-names.js";
+import { extensionToolName, resolveExtensionEntrypoint } from "../domains/extensions/command-schema.js";
+import { parseExtensionManifest } from "../domains/extensions/discovery.js";
+import { extensionContentDigestWithCapture } from "../domains/extensions/integrity.js";
+import { listInstalledExtensions } from "../domains/extensions/state.js";
+import {
+	type ExtensionCommandTool,
+	type ExtensionDiagnostic,
+	isLoadableExtension,
+	type LoadableExtension,
+} from "../domains/extensions/types.js";
+import type { ToolRegistry, ToolSpec } from "./registry.js";
+
+const MAX_INPUT_BYTES = 64 * 1024;
+
+/** Serialize a fixed argv vector only for the existing shell safety classifier. No shell executes this text. */
+function quoted(value: string): string {
+	return `'${value.replaceAll("'", "'\\''")}'`;
+}
+
+function jsonInput(args: Record<string, unknown>): string {
+	const input = JSON.stringify(args);
+	if (Buffer.byteLength(input) > MAX_INPUT_BYTES) throw new Error(`command tool input exceeds ${MAX_INPUT_BYTES} bytes`);
+	return input;
+}
+
+function commandVector(extension: LoadableExtension, tool: ExtensionCommandTool): { file: string; args: string[] } {
+	const entrypoint = resolveExtensionEntrypoint(extension.rootPath, tool.entrypoint);
+	return tool.runtime === "node"
+		? { file: process.execPath, args: ["--", entrypoint] }
+		: { file: "python3", args: ["-I", entrypoint] };
+}
+
+/** Parse declarations from the exact manifest bytes included in the verified tree. */
+function verifiedCommands(extension: LoadableExtension): ExtensionCommandTool[] {
+	const manifestName = path.basename(extension.manifestPath);
+	const verified = extensionContentDigestWithCapture(extension.rootPath, { capture: [manifestName] });
+	if (verified.digest !== extension.provenance.contentDigest)
+		throw new Error("installed extension changed while loading tools");
+	const bytes = verified.captured.get(manifestName);
+	if (!bytes) throw new Error("verified extension manifest bytes are absent");
+	const parsed = parseExtensionManifest(
+		manifestName.endsWith(".json") ? JSON.parse(bytes.toString("utf8")) : parseYaml(bytes.toString("utf8")),
+		extension.manifestPath,
+	);
+	if (!parsed.manifest || parsed.diagnostics.some((entry) => entry.type === "error"))
+		throw new Error("verified extension manifest is invalid");
+	if (parsed.manifest.id !== extension.id || parsed.manifest.version !== extension.version)
+		throw new Error("verified extension identity changed while loading tools");
+	return parsed.manifest.capabilities?.tools ?? [];
+}
+
+function createCommandTool(extension: LoadableExtension, tool: ExtensionCommandTool, cwd: string): ToolSpec {
+	const name = extensionToolName(extension.id, tool.name) as DynamicToolName;
+	const vector = commandVector(extension, tool);
+	return {
+		name,
+		description: `${tool.description}\nHarness extension ${extension.id}@${extension.version}; runs an installed command with JSON input and output.`,
+		parameters: tool.inputSchema as TSchema,
+		baseActionClass: "execute",
+		executionMode: "sequential",
+		sourceInfo: { path: extension.manifestPath, scope: "domain", extension: extension.provenance },
+		metadata: {
+			objective: tool.description,
+			uiLabel: `${extension.id}/${tool.name}`,
+			retrySafety: "not_retry_safe",
+			resultSizePolicy: { kind: "bounded", maxBytes: tool.maxOutputBytes ?? 600000 },
+			costLatency: "local_slow",
+		},
+		safetyCall(args) {
+			// The vector stays execution-class even for inputs such as {op:"read"}.
+			let input = "[invalid JSON input]";
+			try {
+				input = jsonInput(args);
+			} catch {
+				/* The body reports bounded input validation. */
+			}
+			return { tool: "bash", args: { command: [vector.file, ...vector.args, input].map(quoted).join(" "), cwd } };
+		},
+		async run(args, options) {
+			try {
+				const input = jsonInput(args);
+				if (!Value.Check(tool.inputSchema as TSchema, args))
+					return { kind: "error", message: `${name}: input does not match its declared JSON schema` };
+				if (options?.signal?.aborted) return { kind: "error", message: `${name}: aborted before execution` };
+				const current = listInstalledExtensions(cwd).find(
+					(entry) => entry.id === extension.id && isLoadableExtension(entry),
+				);
+				if (
+					!current ||
+					!isLoadableExtension(current) ||
+					current.scope !== extension.scope ||
+					current.provenance.canonicalRoot !== extension.provenance.canonicalRoot ||
+					current.provenance.contentDigest !== extension.provenance.contentDigest
+				) {
+					return {
+						kind: "error",
+						message: `${name}: extension disabled, removed, replaced, or changed; restart after reviewing its installation`,
+					};
+				}
+				const activeVector = commandVector(current, tool);
+				const result = await runCommandVector(activeVector.file, [...activeVector.args, input], {
+					cwd,
+					workspaceRoot: cwd,
+					timeoutMs: tool.timeoutMs ?? 120000,
+					maxOutputBytes: tool.maxOutputBytes ?? 600000,
+					...(options?.signal ? { signal: options.signal } : {}),
+				});
+				const details = {
+					extension: extension.provenance,
+					argv: [result.file, ...result.args],
+					cwd: result.cwd,
+					exitCode: result.exitCode,
+					durationMs: result.durationMs,
+					aborted: result.aborted,
+					timedOut: result.timedOut,
+					outputCapped: result.outputCapped,
+					stderr: result.stderr,
+				};
+				if (result.aborted || result.timedOut || result.outputCapped || result.exitCode !== 0) {
+					const reason = result.aborted
+						? "aborted"
+						: result.timedOut
+							? "timed out"
+							: result.outputCapped
+								? "output limit exceeded"
+								: `exited with code ${result.exitCode}`;
+					return { kind: "error", message: `${name}: ${reason}`, details };
+				}
+				try {
+					return { kind: "ok", output: JSON.stringify(JSON.parse(result.stdout)), details };
+				} catch {
+					return { kind: "error", message: `${name}: command stdout must contain one JSON value`, details };
+				}
+			} catch (error) {
+				return { kind: "error", message: `${name}: ${error instanceof Error ? error.message : String(error)}` };
+			}
+		},
+	};
+}
+
+/**
+ * Freeze installed harness tool schemas at registry construction, in sessions and native workers.
+ * Registration never imports or executes package code. Lifecycle mutations revoke calls immediately;
+ * new or updated schemas enter the next session/worker, keeping approved worker surfaces stable.
+ */
+export function registerHarnessExtensionTools(registry: ToolRegistry, cwd = process.cwd()): ExtensionDiagnostic[] {
+	const diagnostics: ExtensionDiagnostic[] = [];
+	for (const extension of listInstalledExtensions(cwd)) {
+		if (!isLoadableExtension(extension) || !extension.capabilities) continue;
+		try {
+			const tools = verifiedCommands(extension).map((tool) => createCommandTool(extension, tool, path.resolve(cwd)));
+			for (const tool of tools) if (registry.get(tool.name)) throw new Error(`tool collision: ${tool.name}`);
+			for (const tool of tools) registry.register(tool);
+		} catch (error) {
+			diagnostics.push({
+				type: "error",
+				path: extension.rootPath,
+				message: `extension ${extension.id}: ${error instanceof Error ? error.message : String(error)}`,
+			});
+		}
+	}
+	return diagnostics;
+}

package/src/tools/observation.ts

@@ -62,6 +62,10 @@ export const OBSERVE_SELF_CAPS = {
 	contextDocs: 16 * 1024,
 	contextSkills: 50 * 1024,
 	contextWorkspace: 50 * 1024,
+	// Library rows are metadata: name, owner, origin, availability, invocation.
+	// A full page of 50 stays well inside this, and a smaller cap than the
+	// skills catalog is what keeps a catalog read from crowding out the turn.
+	contextLibrary: 16 * 1024,
 } as const;
 
 // Per-turn observation budget pool. One pool per sessionId:turnId shared by

package/src/tools/policy.ts

@@ -81,7 +81,13 @@ const OBSERVE_ENVELOPE_SELF_CAPS: ReadonlyArray<[BuiltinToolName, () => number]>
 	[ToolNames.CodeNav, () => OBSERVE_SELF_CAPS.codeNav],
 	[
 		ToolNames.Context,
-		() => Math.max(OBSERVE_SELF_CAPS.contextDocs, OBSERVE_SELF_CAPS.contextSkills, OBSERVE_SELF_CAPS.contextWorkspace),
+		() =>
+			Math.max(
+				OBSERVE_SELF_CAPS.contextDocs,
+				OBSERVE_SELF_CAPS.contextSkills,
+				OBSERVE_SELF_CAPS.contextWorkspace,
+				OBSERVE_SELF_CAPS.contextLibrary,
+			),
 	],
 ];
 

package/src/tools/registry.ts

@@ -77,6 +77,8 @@ export function resolveToolPromptHint(
 export interface ToolSourceInfo {
 	path: string;
 	scope: ToolSourceScope;
+	/** Verified installed capability identity, when this is a harness extension tool. */
+	extension?: import("../domains/extensions/types.js").ExtensionProvenance;
 }
 
 export interface ToolResultSizePolicy {
@@ -127,6 +129,8 @@ export interface ToolSpec {
 	parameters: TSchema;
 	/** Base action class for this tool when arguments are trivial. */
 	baseActionClass: ActionClass;
+	/** Harness-owned projection of executable effects for the safety engine. Never package-supplied code. */
+	safetyCall?(args: Record<string, unknown>): ClassifierCall;
 	/**
 	 * Per-tool execution mode. Read-only tools set `"parallel"` so the model
 	 * can batch scans; mutating or filesystem-racing tools set `"sequential"`
@@ -482,7 +486,12 @@ export function createRegistry(deps: RegistryDeps): ToolRegistry {
 				});
 				const digest = toolResultDigestFor(spec, result, resultDisposition, options);
 				const afterEffects = runToolHook("after_tool", spec, call, decision, options, result, digest);
-				const finalResult = shapeToolResult(spec, applyToolResultEffects(result, afterEffects), options, resultDisposition);
+				const finalResult = shapeToolResult(
+					spec,
+					applyToolResultEffects(result, [...beforeEffects, ...afterEffects]),
+					options,
+					resultDisposition,
+				);
 				return { kind: "ok", result: finalResult, decision };
 			} catch (err) {
 				const message = err instanceof Error ? err.message : String(err);
@@ -491,7 +500,12 @@ export function createRegistry(deps: RegistryDeps): ToolRegistry {
 				const afterEffects = runToolHook("after_tool", spec, call, decision, options, result, digest);
 				return {
 					kind: "ok",
-					result: shapeToolResult(spec, applyToolResultEffects(result, afterEffects), options, resultDisposition),
+					result: shapeToolResult(
+						spec,
+						applyToolResultEffects(result, [...beforeEffects, ...afterEffects]),
+						options,
+						resultDisposition,
+					),
 					decision,
 				};
 			}
@@ -532,7 +546,21 @@ export function createRegistry(deps: RegistryDeps): ToolRegistry {
 			return { kind: "terminal", verdict: { kind: "not_visible", reason: `tool not registered: ${call.tool}` } };
 		}
 		const level = deps.autonomy?.() ?? DEFAULT_AUTONOMY_LEVEL;
-		const decision = applyRegisteredToolClassification(deps.safety.evaluate(call, grant ? "confirmed" : undefined), spec);
+		const directDecision = applyRegisteredToolClassification(
+			deps.safety.evaluate(call, grant ? "confirmed" : undefined),
+			spec,
+		);
+		const projectedCall = spec.safetyCall?.(call.args ?? {});
+		const projectedDecision =
+			projectedCall && directDecision.kind !== "block"
+				? applyRegisteredToolClassification(deps.safety.evaluate(projectedCall, grant ? "confirmed" : undefined), spec)
+				: undefined;
+		// Both the public capability and its underlying effects must pass. A trusted
+		// projection cannot bypass a rule targeting the capability's own name.
+		const decision =
+			directDecision.kind === "block" || (directDecision.kind === "ask" && projectedDecision?.kind !== "block")
+				? directDecision
+				: (projectedDecision ?? directDecision);
 		// Stage 1, the safety net (level-independent): engine blocks are final;
 		// engine asks are confirm rails that park at every level. read-only is
 		// the exception by definition: approvals are never invoked there, so a

package/src/tools/worker-evidence.ts

@@ -168,6 +168,11 @@ export function receiptEvidenceLabels(
 		...receiptAdmissionLabels(receipt),
 		...receiptActivityLabels(receipt, status),
 		briefing,
+		...(receipt.workerContext
+			? [
+					`context=${receipt.workerContext.mode} tokens:${receipt.workerContext.estimatedTokens} omitted:${receipt.workerContext.omittedMessages} sha256:${receipt.workerContext.contentHash}`,
+				]
+			: []),
 		projectContext,
 	];
 }