@namzu/sdk 45.1.0 → 46.0.0

package/src/pricing/rates.source.json

@@ -56,11 +56,32 @@
 		{
 			"providerId": "anthropic",
 			"unmetered": false,
-			"verified": "2026-08-10",
+			"verified": "2026-09-24",
 			"promptIncludesCacheReads": false,
 			"reportsCacheWrites": true,
-			"note": "The last two rows exist because the driver's own offline catalogue offers those models and this table did not price them — a lookup-key gap that reads as `cost unknown` and is invisible to the generator's own check, which only proves the module matches this file. `providers/anthropic` asserts the two lists agree. Vendor list prices. Cache read is the vendor's published 0.1x of the input rate; cache write is its published 1.25x for the five-minute entry, which is the default TTL and the one the driver's `cacheControl: { type: 'auto' }` asks for. A time-limited introductory rate applied to one model at the time of entry; this table has no time dimension and records the list rate, so a turn inside a promotional window is over-reported rather than mis-modelled.",
+			"note": "The last two rows exist because the driver's own offline catalogue offers those models and this table did not price them — a lookup-key gap that reads as `cost unknown` and is invisible to the generator's own check, which only proves the module matches this file. `providers/anthropic` asserts the two lists agree. Vendor list prices, every row checked against its pricing page on the `verified` date. Cache read is the vendor's published 0.1x of the input rate, except on the three models it prices differently: 0.05x on claude-opus-5-5 and 0.025x on claude-fable-5-1 and claude-mythos-5-1, entered at the published rate rather than derived. Cache write is its published 1.25x for the five-minute entry, which is the default TTL and the one the driver's `cacheControl: { type: 'auto' }` asks for. claude-sonnet-5 launched at an introductory $2/$10 with $3/$15 scheduled from 2026-09-01, and this table recorded the scheduled rate; the vendor has since made $2/$10 the standard price and cancelled the increase. The table has no time dimension, so a future promotional window is still recorded at the list rate and over-reported rather than mis-modelled.",
 			"models": [
+				{
+					"id": "claude-fable-5-1",
+					"inputPer1M": 10,
+					"outputPer1M": 50,
+					"cacheReadPer1M": 0.25,
+					"cacheWritePer1M": 12.5
+				},
+				{
+					"id": "claude-mythos-5-1",
+					"inputPer1M": 10,
+					"outputPer1M": 50,
+					"cacheReadPer1M": 0.25,
+					"cacheWritePer1M": 12.5
+				},
+				{
+					"id": "claude-opus-5-5",
+					"inputPer1M": 4,
+					"outputPer1M": 20,
+					"cacheReadPer1M": 0.2,
+					"cacheWritePer1M": 5
+				},
 				{
 					"id": "claude-fable-5",
 					"inputPer1M": 10,
@@ -105,10 +126,10 @@
 				},
 				{
 					"id": "claude-sonnet-5",
-					"inputPer1M": 3,
-					"outputPer1M": 15,
-					"cacheReadPer1M": 0.3,
-					"cacheWritePer1M": 3.75
+					"inputPer1M": 2,
+					"outputPer1M": 10,
+					"cacheReadPer1M": 0.2,
+					"cacheWritePer1M": 2.5
 				},
 				{
 					"id": "claude-sonnet-4-6",

package/src/public-runtime.ts

@@ -923,7 +923,13 @@ export {
 // The one reader of a bash command line the gate itself uses. A host that
 // writes a `predicate` rule about what a line runs decides on this reading,
 // so its rule and the SDK's own never disagree about where a quote ends.
-export { lexShellCommandLine } from './authorization/shell-lexer.js'
+// `nestedShellCommand` says which `-c` payloads that reading already
+// includes, so a host treats every other text a program runs as unread.
+export {
+	NESTED_SHELLS,
+	lexShellCommandLine,
+	nestedShellCommand,
+} from './authorization/shell-lexer.js'
 
 // NZ-BOOT-03: the module-attributed invariant registry. `compaction.ts` and
 // `claim-disk.ts` register themselves against the shared `invariants`
@@ -1302,6 +1308,8 @@ export {
 	REVIEW_EXEMPT_WRITES,
 	REVIEW_MODES,
 	SANDBOX_ESCAPE_UNATTENDED_REFUSAL,
+	SCREEN_CONSENT_DECLINED_FEEDBACK,
+	SCREEN_CONSENT_UNATTENDED_REFUSAL,
 	STRICT_MODE_REFUSAL,
 	batchNeedsReview,
 	createReviewHandler,
@@ -1433,7 +1441,13 @@ export type {
 export type { BroadcastHandoffDeps } from './session/handoff/broadcast.js'
 export type { SingleHandoffDeps } from './session/handoff/single.js'
 export type { InterventionChainLoader } from './session/intervention/prev-artifact.js'
-export type { ActionInput } from './tools/builtins/computer-use.js'
+export type {
+	ActionInput,
+	ComputerUseTool,
+	ComputerUseToolOptions,
+	ImageSize,
+	ScreenshotLimits,
+} from './tools/builtins/computer-use.js'
 export type { Project } from './types/project/entity.js'
 export type { CreatedLogger } from './utils/log/create-logger.js'
 export type {

package/src/public-tools.ts

@@ -66,7 +66,21 @@ export { WaitForJobTool } from './tools/builtins/wait-for-job.js'
 // NOT in the default builtin set: a turn with no skills has nothing for it
 // to do, and offering a tool that can only refuse is worse than not
 // offering it. Hosts register it alongside a skills registry.
-export { SKILL_TOOL_NAME, SkillTool, parseAllowedTools } from './tools/builtins/skill.js'
+// `createSkillTool` takes what the host knows about where its model's tools
+// run: `resolveModelDirectory` names the directory the model can open for
+// each skill, which a sandboxed host's own path is not.
+export {
+	SKILL_TOOL_NAME,
+	SkillTool,
+	createSkillTool,
+	parseAllowedTools,
+} from './tools/builtins/skill.js'
+export type {
+	SkillDirectoryContext,
+	SkillDirectoryRequest,
+	SkillDirectoryResolver,
+	SkillToolOptions,
+} from './tools/builtins/skill.js'
 // Both declare `category: 'network'`, which is what the authorization
 // presets branch on. NOT in the default builtin set: a turn with no web
 // provider has nothing for them to do, and only the `unattended` preset --
@@ -105,7 +119,11 @@ export {
 } from './tools/builtins/structuredOutput.js'
 export {
 	COMPUTER_USE_TOOL_NAME,
+	HIGH_RES_SCREENSHOT_LIMITS,
+	STANDARD_SCREENSHOT_LIMITS,
+	computerUseUnavailableReason,
 	createComputerUseTool,
+	screenshotTargetSize,
 } from './tools/builtins/computer-use.js'
 // The browser contract: the two tools over a host a separate package
 // provides, and the canonicalisers a host and a site-rule compiler must share

package/src/public-types.ts

@@ -272,6 +272,7 @@ export type { PermissionPreset } from './authorization/index.js'
 export type { EvaluateRuleOptions } from './authorization/rules.js'
 export type {
 	ShellCommand,
+	NestedShellCommand,
 	ShellLexOptions,
 	ShellLexResult,
 	ShellRedirection,
@@ -403,6 +404,7 @@ export type {
 	ReviewExemption,
 	ReviewMode,
 	ReviewPolicyOptions,
+	ScreenConsentRecord,
 	ToolReviewAnswer,
 	ToolReviewPrompt,
 	ToolReviewRequest,
@@ -671,11 +673,14 @@ export type {
 	ScheduleBrowserSiteLevel,
 	ScheduleConfirmAnswer,
 	ScheduleConfirmRequest,
+	ScheduleJobChanges,
 	ScheduleJobDraft,
 	ScheduleJobPreview,
 	ScheduleJobSummary,
+	ScheduleJobUpdateProposal,
 	ScheduleRuleEffect,
 	ScheduleToolHost,
+	ScheduleUpdateRequest,
 	SessionLoop,
 	SessionLoopHost,
 } from './tools/schedules/index.js'

package/src/registry/tool/callable.ts

@@ -0,0 +1,37 @@
+import type { ToolRegistryContract } from '../../types/tool/index.js'
+
+/**
+ * The tools a call on this step can reach: registered now, active, and on
+ * the step's allow-list when it has one. In registry order.
+ *
+ * This is what every "Available: …" a model is shown must say, because a
+ * model takes it literally and calls the next name on it. Two answers used
+ * to build that list separately and disagreed. A refusal echoed the step's
+ * allow-list, which is a snapshot taken when the request was built and so
+ * can name a tool unregistered since — a connector that disconnected — or
+ * one that is deferred or suspended, which the executor refuses. An
+ * unknown-tool error listed the whole registry, which on a narrowed step is
+ * mostly tools the step refuses. Each sent the model to a name the other
+ * one answered, and a run went round between them until it was stopped.
+ *
+ * `allowed` absent means the step is not narrowed. An EMPTY list is a step
+ * that may call nothing, and the answer is then empty too.
+ */
+export function callableToolNames(
+	tools: Pick<ToolRegistryContract, 'listNames' | 'getAvailability'>,
+	allowed: readonly string[] | undefined,
+): string[] {
+	const permitted = allowed === undefined ? undefined : new Set(allowed)
+	return tools
+		.listNames()
+		.filter(
+			(name) =>
+				(permitted === undefined || permitted.has(name)) &&
+				tools.getAvailability(name) === 'active',
+		)
+}
+
+/** The list as a model reads it: comma-separated, or `(none)`. */
+export function formatToolNames(names: readonly string[]): string {
+	return names.length > 0 ? names.join(', ') : '(none)'
+}

package/src/registry/tool/execute.ts

@@ -20,6 +20,7 @@ import type {
 import { toErrorMessage } from '../../utils/error.js'
 import { cloneJsonValue as clonePreparedInput } from '../../utils/json-snapshot.js'
 import { ManagedRegistry } from '../ManagedRegistry.js'
+import { callableToolNames, formatToolNames } from './callable.js'
 import { renderToolSchema, toolWireSchema } from './schema.js'
 import { ToolResultHalted, screenToolResult } from './screen.js'
 
@@ -636,9 +637,15 @@ Executable tool names, descriptions, and JSON input schemas are attached through
 				// that may call nothing, and treating it as "no restriction" is
 				// the fail-open reading this codebase has already been bitten by
 				// once, in the delegate roster.
+				//
+				// What it says is available is what would run, not the list
+				// itself: the list was taken when the request was built, and a
+				// name on it may since have been unregistered, or be deferred or
+				// suspended. Echoing it sent a model to a name that was then
+				// answered "unknown tool". See `callableToolNames`.
 				const allowed = context.allowedTools
 				if (allowed !== undefined && !allowed.includes(toolName)) {
-					const msg = `Tool "${toolName}" is not available on this step. Available: ${allowed.length > 0 ? allowed.join(', ') : '(none)'}`
+					const msg = `Tool "${toolName}" is not available on this step. Available: ${formatToolNames(callableToolNames(this, allowed))}`
 					this.log.warn('Blocked a tool outside the step allow-list', {
 						[GENAI.TOOL_NAME]: toolName,
 						'namzu.registry.allowed': allowed.length,

package/src/runtime/query/executor/tool-call-admission.ts

@@ -1,4 +1,5 @@
 import { GENAI, NAMZU } from '../../../constants/telemetry/index.js'
+import { callableToolNames, formatToolNames } from '../../../registry/tool/callable.js'
 import { renderToolSchema } from '../../../registry/tool/schema.js'
 import type { ToolCall } from '../../../types/message/index.js'
 import type { PluginHookResult } from '../../../types/plugin/index.js'
@@ -24,16 +25,43 @@ import { skippedToolResultText } from '../plugin-hooks.js'
  * here dispatches a tool, and nothing here writes a result: that is the
  * executor's half.
  *
- * The family reads exactly three things off the executor it serves, and they
+ * The family reads exactly four things off the executor it serves, and they
  * arrive as one value rather than as a captured reference: the tool registry
- * config, the event sink and the logger. `config` in particular is read
- * per call and never held — `ToolExecutor.setSandbox` REPLACES it, so a host
- * captured once would hand the next admission a stale sandbox.
+ * config, the event sink, the logger and the current step's allow-list.
+ * `config` in particular is read per call and never held —
+ * `ToolExecutor.setSandbox` REPLACES it, so a host captured once would hand
+ * the next admission a stale sandbox.
  */
 export interface ToolAdmissionHost {
 	readonly config: ToolExecutorConfig
 	readonly emitEvent: EmitEvent
 	readonly log: Logger
+	/**
+	 * What the current step may call: the step's own list where
+	 * `prepareStep` gave one, the turn's `allowedTools` otherwise, absent
+	 * when nothing narrowed the turn. NOT `config.allowedTools`, which is
+	 * only the turn's; the step's list lives on the executor.
+	 *
+	 * Required, with `undefined` as a value, so that a host has to say.
+	 * Leaving it out would list the whole registry to a model on a narrowed
+	 * step, which is the answer that sent a model round in a circle.
+	 */
+	readonly allowedTools: readonly string[] | undefined
+}
+
+/**
+ * The answer to a call naming a tool the registry does not hold, without
+ * the `Error: ` a direct call's result carries.
+ *
+ * It lists what the current step can call — the same list a step refusal
+ * gives — rather than what the registry holds. The registry's own
+ * "Not found" lists every tool it has, and on a narrowed step that is
+ * mostly tools the next call would be refused.
+ */
+export function unknownToolMessage(host: ToolAdmissionHost, toolName: string): string {
+	return `Unknown tool "${toolName}". Available: ${formatToolNames(
+		callableToolNames(host.config.tools, host.allowedTools),
+	)}`
 }
 
 export async function runPreToolHook(
@@ -163,7 +191,11 @@ export async function prepareDirectCall(
 		try {
 			preparation = prepare.call(host.config.tools, toolName, parsed)
 		} catch (err) {
-			const message = `Error: Unknown or unavailable tool "${toolName}": ${toErrorMessage(err)}`
+			// A name the registry does not hold gets the step's list, not the
+			// registry's "Not found", which lists everything it holds.
+			const message = isUnregistered(host, toolName)
+				? `Error: ${unknownToolMessage(host, toolName)}`
+				: `Error: Unknown or unavailable tool "${toolName}": ${toErrorMessage(err)}`
 			const repair =
 				!repairUsed && host.config.repairToolCall
 					? await requestRepair(host, toolCall, toolName, {
@@ -295,13 +327,15 @@ function interpretPreToolResults(
  * broken will not do better on a second look, and an unbounded loop
  * here is a hang rather than a degradation.
  *
- * `invalid_json` is the ONLY failure that stops the call here, and it
- * stopped it before this function existed too. `unknown_tool` and
- * `schema_validation` merely OFFER the repair and otherwise fall
- * through to the registry, which reports both with better messages —
- * its schema error already ships a "Required: <field>: <type>" hint the
- * model can self-correct from. So with no repairer configured this is
- * behaviorally identical to the bare `JSON.parse` it replaced.
+ * `invalid_json` stops the call here, and it stopped it before this
+ * function existed too. So does an `unknown_tool` the registry confirms
+ * it does not hold: the registry's own answer to that is "Not found",
+ * listing every tool it has, where the model needs the ones this step can
+ * call — see `unknownToolMessage`. `schema_validation`, and an unknown
+ * tool on a registry that cannot say, merely OFFER the repair and
+ * otherwise fall through to the registry, whose schema error already
+ * ships a "Required: <field>: <type>" hint the model can self-correct
+ * from.
  */
 export async function resolveCall(
 	host: ToolAdmissionHost,
@@ -322,7 +356,10 @@ export async function resolveCall(
 				: null
 
 		if (!repair) {
-			if (failure.reason === 'invalid_json') {
+			if (
+				failure.reason === 'invalid_json' ||
+				(failure.reason === 'unknown_tool' && isUnregistered(host, toolName))
+			) {
 				return { ok: false, toolName, message: failure.message }
 			}
 			return { ok: true, toolName, input: parseArguments(raw) }
@@ -392,11 +429,13 @@ function inspectCall(
 	const tool = host.config.tools.get?.(toolName)
 	if (!tool) {
 		// Either the model named a tool that does not exist, or this
-		// registry does not implement `get`. Both are the registry's to
-		// answer; a repairer still gets offered the `unknown_tool` case.
+		// registry does not implement `get`. A repairer gets offered both;
+		// only the first is answered here, and with the step's list.
 		return {
 			reason: 'unknown_tool',
-			message: `Error: Unknown tool "${toolName}"`,
+			message: isUnregistered(host, toolName)
+				? `Error: ${unknownToolMessage(host, toolName)}`
+				: `Error: Unknown tool "${toolName}"`,
 		}
 	}
 
@@ -416,6 +455,11 @@ function inspectCall(
 	return null
 }
 
+/** The registry says it does not hold this name — not merely that it cannot look it up. */
+export function isUnregistered(host: ToolAdmissionHost, toolName: string): boolean {
+	return typeof host.config.tools.has === 'function' && !host.config.tools.has(toolName)
+}
+
 async function requestRepair(
 	host: ToolAdmissionHost,
 	toolCall: ToolCall,

package/src/runtime/query/executor.ts

@@ -55,11 +55,13 @@ import { type BackgroundJobRegistry, type JobProcess, bindOwner } from '../jobs/
 import {
 	type ToolAdmissionHost,
 	formatFailedToolOutput,
+	isUnregistered,
 	prepareDirectCall,
 	repairTruncatedCall,
 	resolveCall,
 	runPreToolHook,
 	truncatedToolInputMessage,
+	unknownToolMessage,
 } from './executor/tool-call-admission.js'
 import { describeVisibleFileEvidence } from './file-evidence-context.js'
 import { seedObservationLedger } from './file-evidence-seed.js'
@@ -2202,10 +2204,12 @@ export class ToolExecutor {
 	}
 
 	/**
-	 * The three things the admission family reads off this executor.
+	 * The four things the admission family reads off this executor.
 	 *
 	 * Built per call rather than held: `setSandbox` REPLACES `config`, so a
-	 * host captured once would hand the next admission a stale sandbox.
+	 * host captured once would hand the next admission a stale sandbox. The
+	 * allow-list is the step's, taken the same way and for a like reason:
+	 * `setStepAllowedTools` replaces it every step.
 	 *
 	 * The one way this differs from the inline code it replaced, which
 	 * re-read `this.config` at every use: an admission that spans a
@@ -2216,7 +2220,12 @@ export class ToolExecutor {
 	 * before the loop, so nothing in this tree can tell them apart.
 	 */
 	private admissionHost(): ToolAdmissionHost {
-		return { config: this.config, emitEvent: this.emitEvent, log: this.log }
+		return {
+			config: this.config,
+			emitEvent: this.emitEvent,
+			log: this.log,
+			allowedTools: this.effectiveAllowedTools(),
+		}
 	}
 
 	private async prepareNestedCall(
@@ -2251,10 +2260,16 @@ export class ToolExecutor {
 		try {
 			preparation = prepare.call(this.config.tools, toolName, input)
 		} catch (err) {
+			// A name the registry does not hold is answered with what this step
+			// can call, as a model's own call is; the registry's "Not found"
+			// lists everything it holds.
+			const host = this.admissionHost()
 			return {
 				kind: 'synthetic',
 				input,
-				message: `Tool "${toolName}" could not be prepared: ${toErrorMessage(err)}`,
+				message: isUnregistered(host, toolName)
+					? unknownToolMessage(host, toolName)
+					: `Tool "${toolName}" could not be prepared: ${toErrorMessage(err)}`,
 				isError: true,
 			}
 		}

package/src/runtime/query/review-policy.ts

@@ -197,6 +197,28 @@ export const SANDBOX_ESCAPE_UNATTENDED_REFUSAL =
 export const OUTSIDE_ROOTS_UNATTENDED_REFUSAL =
 	"Refused: a call in this batch reaches a path outside the working directory and the added directories, which needs a person to approve it each time, and nobody can be asked in this session. Nothing in this batch ran. Stay inside the working directory, or tell the user which directory you need so they can add it to the session (the CLI's --add-dir)."
 
+/**
+ * What the model is told when a batch would show it the operator's screen for
+ * the first time in a session and nobody can be asked.
+ */
+export const SCREEN_CONSENT_UNATTENDED_REFUSAL =
+	"Refused: this call would send what is on the user's screen to the model provider, which a person agrees to once per session, and nobody can be asked in this session. Nothing in this batch ran. Tell the user computer use needs their consent in an interactive session."
+
+/** What the model is told when the operator declines to share the screen. */
+export const SCREEN_CONSENT_DECLINED_FEEDBACK =
+	'The user declined to share their screen in this session. Nothing in this batch ran. Do not take screenshots or read windows again; ask the user how they want to proceed.'
+
+/**
+ * The sessions whose operator agreed to let the model see the screen.
+ *
+ * A host keeps one for as long as its sessions live and hands the same box to
+ * every policy it builds, so a mode switch keeps the answer and a new session
+ * (a different id) is asked again. The policy only adds to it.
+ */
+export interface ScreenConsentRecord {
+	readonly sessions: Set<string>
+}
+
 /** The batch a person is asked about. */
 export interface ToolReviewRequest {
 	/** Originating session, preserved by createReviewHandler for host attribution. */
@@ -204,6 +226,14 @@ export interface ToolReviewRequest {
 	/** Originating turn, preserved by createReviewHandler for host attribution. */
 	readonly turnId?: TurnId
 	readonly toolCalls: readonly ToolCallSummary[]
+	/**
+	 * This batch would send the screen to the model provider for the first
+	 * time in the session (see {@link ReviewPolicyOptions.screenConsent}).
+	 * The question is whether the model may see the screen for the rest of
+	 * the session; a yes also approves this batch, and later screen captures
+	 * in the session run without asking.
+	 */
+	readonly screenConsent?: true
 }
 
 export type ToolReviewAnswer =
@@ -250,6 +280,24 @@ export interface ReviewPolicyOptions {
 	 * either way.
 	 */
 	readonly skillGrants?: 'honour' | 'ignore'
+	/**
+	 * Ask once per session before the model first sees the screen.
+	 *
+	 * With a record, a batch holding a call that captures the screen
+	 * ({@link capturesScreen}) in a session not yet in `sessions` is put to
+	 * a person first, as a {@link ToolReviewRequest.screenConsent} request,
+	 * even when every call in it only reads: in `prompt`, `accept-edits` and
+	 * `plan`. A yes adds the session; a no refuses the batch. `strict`
+	 * refuses such a call unless a rule allowed it, `auto` never asks, and a
+	 * policy without a `prompt` refuses. A call a rule allowed is never
+	 * asked about. Omitted, the screen is treated like any other read.
+	 */
+	readonly screenConsent?: ScreenConsentRecord
+	/**
+	 * Which calls capture the screen. Default: the tool's own
+	 * `capturesScreen` declaration, read from `registry`; nothing without one.
+	 */
+	readonly capturesScreen?: (name: string, input: unknown) => boolean
 }
 
 /**
@@ -276,10 +324,61 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 		options.exempt ??
 		(registry ? (name, input) => isReviewExempt(registry, name, input) : () => false)
 	const remembered = options.remembered ?? { all: false }
+	const capturesScreen =
+		options.capturesScreen ??
+		(registry
+			? (name: string, input: unknown) => {
+					const tool = registry.get(name) ?? registry.get(name.toLowerCase())
+					return tool?.capturesScreen?.(input) === true
+				}
+			: () => false)
 	return async (request): Promise<HITLResumeDecision> => {
 		if (request.type !== 'tool_review') {
 			return request.type === 'plan_approval' ? { action: 'approve_plan' } : { action: 'continue' }
 		}
+		// The one answer a person gives for this batch. The screen question
+		// below shows the whole batch, so its yes also answers any question
+		// the rest of this function would ask; nobody is asked twice.
+		let answered: ToolReviewAnswer | undefined
+		const ask = async (screenConsent?: true): Promise<ToolReviewAnswer> =>
+			answered ??
+			(prompt as ToolReviewPrompt)({
+				sessionId: request.sessionId,
+				turnId: request.turnId,
+				toolCalls: request.toolCalls,
+				...(screenConsent ? { screenConsent } : {}),
+			})
+		// The first look at the screen in a session is the operator's to allow:
+		// what is on it goes to the model provider, and a screenshot reads as
+		// harmlessly as a file read to every rule below. Asked once, in the
+		// modes where a person decides; a rule that allowed the call already
+		// said yes, and a call a rule denied will not run.
+		const consent = options.screenConsent
+		const sessionKey = String(request.sessionId ?? '')
+		if (
+			consent &&
+			mode !== 'auto' &&
+			!consent.sessions.has(sessionKey) &&
+			request.toolCalls.some(
+				(tc) =>
+					tc.authorization?.decision !== 'allow' &&
+					tc.authorization?.decision !== 'deny' &&
+					capturesScreen(tc.name, tc.input),
+			)
+		) {
+			if (mode === 'strict') return { action: 'reject_tools', feedback: STRICT_MODE_REFUSAL }
+			if (!prompt) return { action: 'reject_tools', feedback: SCREEN_CONSENT_UNATTENDED_REFUSAL }
+			const answer = await ask(true)
+			if (answer.kind === 'reject') {
+				return {
+					action: 'reject_tools',
+					feedback: answer.feedback ?? SCREEN_CONSENT_DECLINED_FEEDBACK,
+				}
+			}
+			consent.sessions.add(sessionKey)
+			if (answer.kind === 'approve-all') remembered.all = true
+			answered = answer
+		}
 		if (!batchNeedsReview(request.toolCalls, exempt)) {
 			return { action: 'approve_tools' }
 		}
@@ -326,11 +425,7 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 					? { action: 'approve_tools', confirmedEscalations: escapes }
 					: { action: 'reject_tools', feedback: SANDBOX_ESCAPE_UNATTENDED_REFUSAL }
 			}
-			const answer = await prompt({
-				sessionId: request.sessionId,
-				turnId: request.turnId,
-				toolCalls: request.toolCalls,
-			})
+			const answer = await ask()
 			if (answer.kind === 'reject') {
 				return {
 					action: 'reject_tools',
@@ -348,11 +443,7 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 		// With nobody to ask it is refused, not approved.
 		if (request.toolCalls.some((tc) => (tc.escalation?.outsidePaths?.length ?? 0) > 0)) {
 			if (!prompt) return { action: 'reject_tools', feedback: OUTSIDE_ROOTS_UNATTENDED_REFUSAL }
-			const answer = await prompt({
-				sessionId: request.sessionId,
-				turnId: request.turnId,
-				toolCalls: request.toolCalls,
-			})
+			const answer = await ask()
 			if (answer.kind === 'reject') {
 				return {
 					action: 'reject_tools',
@@ -383,6 +474,7 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 				),
 		)
 		if (
+			answered === undefined &&
 			options.skillGrants !== 'ignore' &&
 			needsPerson.length > 0 &&
 			needsPerson.every(isSkillGranted)
@@ -392,11 +484,7 @@ export function createReviewHandler(options: ReviewPolicyOptions = {}): ResumeHa
 				skillGranted: needsPerson.map((tc) => tc.id),
 			}
 		}
-		const answer = await prompt({
-			sessionId: request.sessionId,
-			turnId: request.turnId,
-			toolCalls: request.toolCalls,
-		})
+		const answer = await ask()
 		switch (answer.kind) {
 			case 'approve':
 				return { action: 'approve_tools' }

package/src/skills/registry.ts

@@ -220,6 +220,12 @@ export class SkillRegistry {
 			registeredName: string
 			description: string
 			location: string
+			/**
+			 * The skill's directory (`Skill.dirPath`); `location` is its SKILL.md.
+			 * Always set here. Declared optional so a subclass that overrides
+			 * `catalog()` without it still compiles.
+			 */
+			directory?: string
 			allowedTools?: string
 			invocation?: 'model' | 'operator' | 'both'
 		}[]
@@ -228,6 +234,7 @@ export class SkillRegistry {
 			registeredName: string
 			description: string
 			location: string
+			directory: string
 			allowedTools?: string
 			invocation?: 'model' | 'operator' | 'both'
 		}> = []
@@ -243,6 +250,7 @@ export class SkillRegistry {
 				registeredName,
 				description: skill.metadata.description,
 				location: join(skill.dirPath, SKILL_FILENAME),
+				directory: skill.dirPath,
 				...(skill.metadata.allowedTools === undefined
 					? {}
 					: { allowedTools: skill.metadata.allowedTools }),