@namzu/sdk 46.0.0 → 48.1.0

package/src/tools/roster.ts

@@ -1,46 +1,97 @@
 /**
- * Narrower rosters from a wider one.
+ * Selecting a narrower roster of tools from a wider one.
  *
- * A delegate that can only look, or a file-defined agent with an allowlist,
- * needs a registry that is the parent's minus something — and every host
- * that builds delegates wrote the same two loops. They live here so the
- * predicate for "read-only" is the one the authorization gate and the
- * prompt exemption already use (`isTrustedReadOnly`), not a third reading
- * of the same flag.
+ * `filterReadOnlyTools`/`filterToolsNamed` (a registry-shaped "copy the
+ * matching subset into a new one") are gone (plan.md v3 §8, a break): a
+ * toolset's own `filtered(ts, selector)` (`toolsets/wrappers.ts`) replaces
+ * both — `filtered(ts, (tool, source) => isTrustedReadOnly(tool, undefined, source))`
+ * for the read-only case, `filtered(ts, names)` for the name-list case —
+ * and, unlike the old registry-level copy, it keeps the inner toolset's
+ * `availability` and stays live over a live source instead of freezing a
+ * snapshot at filter time.
  *
- * Both filters INTERSECT: a name in an allowlist that the source does not
- * carry is simply not there. A filter can never widen.
+ * **Filter each contributing toolset, then combine — never the reverse.**
+ * `filtered`'s predicate reads `source` from the ONE toolset it is called
+ * on (`ToolPredicate`, `toolsets/types.ts`). Call it on a wide toolset
+ * `combineToolsets` already merged from several sources and `source` is
+ * the merge's own umbrella source, not any one contributor's — so a
+ * predicate built to keep only trusted-read-only tools would keep an
+ * untrusted MCP server's tool too, because it never sees that server's
+ * source. Filter each source's toolset on its own, THEN combine the
+ * filtered results:
+ *
+ *     const readOnlyOnly = parentToolsets.map((ts) =>
+ *       filtered(ts, (tool, source) => isTrustedReadOnly(tool, undefined, source)),
+ *     )
+ *     // readOnlyOnly: readonly Toolset[], hand it to a child ToolManager
+ *     // directly, or combineToolsets(...) it if the caller needs one Toolset.
  */
 
-import { ToolRegistry } from '../registry/tool/execute.js'
-import type { ToolRegistryContract } from '../types/tool/index.js'
-import { isTrustedReadOnly } from './trusted-read-only.js'
+import type { ToolDefinition } from '../types/tool/index.js'
 
 /**
- * The tools that declare themselves read-only and are trusted to say so.
+ * How a capability, toolset wrapper or host names the tools it wants,
+ * without maintaining a parallel name list of its own:
+ *
+ * - a list of exact tool names;
+ * - a partial match against `ToolDefinition.metadata` — every key the
+ *   selector names must be present, with a deep-equal value (a nested plain
+ *   object recurses the same way); a key the tool's metadata does not carry,
+ *   or carries a different value for, fails the match. An empty object
+ *   selector matches every tool;
+ * - a predicate, for anything the two shapes above cannot express.
  *
- * Decided by `isTrustedReadOnly` with no input, which is each tool's own
- * declaration: a new read-only builtin joins the roster without this file
- * learning its name, and a connected server's tool that merely CLAIMS to be
- * read-only stays out unless its provenance is trusted.
+ * Synchronous only, unlike some other agent frameworks' equivalent selector
+ * type (which also allow an async predicate): every place namzu filters a
+ * roster today does so synchronously, and an `Awaitable` branch nothing
+ * calls is a surface with nothing to test.
  */
-export function filterReadOnlyTools(source: ToolRegistryContract): ToolRegistry {
-	const filtered = new ToolRegistry()
-	for (const tool of source.getAll()) {
-		if (isTrustedReadOnly(tool, undefined)) filtered.register(tool)
-	}
-	return filtered
+export type ToolSelector =
+	| readonly string[]
+	| Readonly<Record<string, unknown>>
+	| ((tool: ToolDefinition) => boolean)
+
+function isPlainObject(value: unknown): value is Readonly<Record<string, unknown>> {
+	return typeof value === 'object' && value !== null && !Array.isArray(value)
 }
 
-/** The tools whose names are listed. Names the source does not carry are ignored. */
-export function filterToolsNamed(
-	source: ToolRegistryContract,
-	names: Iterable<string>,
-): ToolRegistry {
-	const allowed = new Set(names)
-	const filtered = new ToolRegistry()
-	for (const tool of source.getAll()) {
-		if (allowed.has(tool.name)) filtered.register(tool)
+function deepEqual(a: unknown, b: unknown): boolean {
+	if (Object.is(a, b)) return true
+	if (Array.isArray(a) && Array.isArray(b)) {
+		return a.length === b.length && a.every((v, i) => deepEqual(v, b[i]))
+	}
+	if (isPlainObject(a) && isPlainObject(b)) {
+		const keysA = Object.keys(a)
+		const keysB = Object.keys(b)
+		return keysA.length === keysB.length && keysA.every((key) => deepEqual(a[key], b[key]))
 	}
-	return filtered
+	return false
+}
+
+/** Every key `expected` names is present in `actual` with a deep-equal value. */
+function metadataIncludes(
+	actual: Readonly<Record<string, unknown>> | undefined,
+	expected: Readonly<Record<string, unknown>>,
+): boolean {
+	const keys = Object.keys(expected)
+	if (keys.length === 0) return true
+	if (!actual) return false
+	return keys.every((key) => {
+		const expectedValue = expected[key]
+		const actualValue = actual[key]
+		return isPlainObject(expectedValue) && isPlainObject(actualValue)
+			? metadataIncludes(actualValue, expectedValue)
+			: deepEqual(actualValue, expectedValue)
+	})
+}
+
+/**
+ * Whether `tool` matches `selector`: a name list, a metadata deep-match, or a
+ * predicate — see {@link ToolSelector}. Never reads anything but `tool.name`
+ * and `tool.metadata`, so it never sees a tool's schema or execution.
+ */
+export function matchesToolSelector(selector: ToolSelector, tool: ToolDefinition): boolean {
+	if (typeof selector === 'function') return selector(tool)
+	if (Array.isArray(selector)) return selector.includes(tool.name)
+	return metadataIncludes(tool.metadata, selector as Readonly<Record<string, unknown>>)
 }

package/src/tools/schedules/schedule-tool.ts

@@ -9,6 +9,7 @@ import type {
 	ScheduleBrowserSiteLevel,
 	ScheduleJobChanges,
 	ScheduleJobDraft,
+	ScheduleJobSummary,
 	ScheduleJobUpdateProposal,
 	ScheduleToolHost,
 } from './types.js'
@@ -42,12 +43,30 @@ const inputSchema = z.object({
 		.regex(/^[a-z0-9][a-z0-9-]{0,62}$/)
 		.optional()
 		.describe('create: job name, lowercase letters, digits and dashes'),
+	kind: z
+		.enum(['agent', 'script', 'script+agent'])
+		.optional()
+		.describe(
+			'create: what the run does. agent (default): the model runs prompt. script: a fixed shell script runs unattended, no model call, no prompt. script+agent: a cheap gate script decides whether to wake the model; wake:false costs nothing. Prefer script/script+agent for a fixed, deterministic check that would otherwise cost tokens for no reason.',
+		),
+	script: z
+		.object({
+			body: z.string().min(1).describe('The exact script text, run verbatim once confirmed'),
+			shell: z.enum(['bash', 'sh']).describe('Which shell reads it; no default'),
+			timeoutMs: z.number().int().positive().optional().describe('The script’s own wall clock'),
+		})
+		.optional()
+		.describe(
+			'create: required when kind is script or script+agent. For script+agent this is the wake-gate: its stdout must be exactly one JSON line, {"wake": boolean, "context": string}.',
+		),
 	prompt: z
 		.string()
 		.min(1)
 		.max(20_000)
 		.optional()
-		.describe('create, update: what the run is asked to do'),
+		.describe(
+			'create, update: what the model run is asked to do. Required for agent and script+agent; refused for a pure script. For script+agent this is handed to the model only when the wake-gate says wake: true.',
+		),
 	when: z
 		.string()
 		.optional()
@@ -101,7 +120,7 @@ const inputSchema = z.object({
 		})
 		.optional()
 		.describe(
-			'create: REQUIRED explicit permission set; there is no default. update: the whole new set, only when the permissions change',
+			'create: REQUIRED explicit permission set; there is no default. A pure script cannot use a browser grant. update: the whole new set, only when the permissions change',
 		),
 	budget: z
 		.object({
@@ -126,10 +145,12 @@ const inputSchema = z.object({
 				.int()
 				.positive()
 				.optional()
-				.describe('Wall clock of one run, in milliseconds'),
+				.describe('Wall clock of one agent phase, in milliseconds'),
 		})
 		.optional()
-		.describe('Limits of ONE run; omit to use the defaults'),
+		.describe(
+			'Agent-phase limits; omit to use the defaults. Refused for a pure script; use script.timeoutMs instead.',
+		),
 	job: z.string().optional().describe('update/pause/resume/delete: job name'),
 	allFolders: z.boolean().optional().describe('list: include jobs of other folders (names only)'),
 })
@@ -150,6 +171,14 @@ function effectsOf(rule: unknown): string[] {
  * Refuse a network tool beside a shell that runs on the host: a scheduled run
  * that can both read the machine and reach the internet, unattended, is the
  * exfiltration shape, and only the operator can choose it.
+ *
+ * For `runKind: 'script'`/`'script+agent'` the "shell" isn't a rule the model
+ * could reach at some later live call — it's the confirmed script's own
+ * body, which unconditionally runs shell commands whenever it runs at all.
+ * The `bash` rule heuristic below answers a question ("could a live call
+ * reach bash") that isn't the one being asked here, so a script/script+agent
+ * job on the host is treated as reaching a shell outright, whatever its
+ * rules say about `bash`.
  */
 function networkWithHostShell(draft: ScheduleJobDraft): boolean {
 	const rules = draft.permissions.rules ?? {}
@@ -157,6 +186,8 @@ function networkWithHostShell(draft: ScheduleJobDraft): boolean {
 		draft.permissions.browser !== undefined ||
 		NETWORK_TOOLS.some((t) => effectsOf(rules[t]).some((e) => e === 'allow' || e === 'ask'))
 	if (!network) return false
+	const onHost = (draft.permissions.execution ?? 'host') === 'host'
+	if ((draft.runKind ?? 'agent') !== 'agent') return onHost
 	const bashEffects = effectsOf(rules.bash)
 	// The read-only preset denies bash; its rules are expanded by the host,
 	// so the draft carries only its name.
@@ -164,7 +195,7 @@ function networkWithHostShell(draft: ScheduleJobDraft): boolean {
 		bashEffects.length > 0
 			? bashEffects.some((e) => e !== 'deny')
 			: draft.permissions.preset !== 'read-only' && draft.permissions.unmatched !== 'deny'
-	return shellPossible && (draft.permissions.execution ?? 'host') === 'host'
+	return shellPossible && onHost
 }
 
 /**
@@ -246,21 +277,38 @@ async function create(
 	input: Input,
 	signal: AbortSignal | undefined,
 ): Promise<ToolResult> {
-	const missing = (['name', 'prompt', 'when', 'permissions'] as const).filter(
+	const runKind = input.kind ?? 'agent'
+	const required: string[] = (['name', 'when', 'permissions'] as const).filter(
 		(k) => input[k] === undefined,
 	)
-	if (missing.length > 0) {
+	if (runKind !== 'script' && input.prompt === undefined) required.push('prompt')
+	if (runKind !== 'agent' && input.script === undefined) required.push('script')
+	if (required.length > 0) {
 		return refuse(
-			`create needs ${missing.join(', ')}. permissions is required: propose an explicit set (a preset and/or rules, plus unmatched).`,
+			`create needs ${required.join(', ')}. permissions is required: propose an explicit set (a preset and/or rules, plus unmatched).`,
 		)
 	}
+	if (runKind === 'agent' && input.script !== undefined) {
+		return refuse('an agent job has no script; omit kind (or set it to agent) to use one')
+	}
+	if (runKind === 'script' && input.prompt !== undefined)
+		return refuse('a pure script job has no prompt; remove prompt')
+	if (runKind === 'script' && input.budget !== undefined) {
+		return refuse(
+			'a pure script job has no agent budget; remove budget and use script.timeoutMs for its timeout',
+		)
+	}
+	if (runKind === 'script' && input.permissions?.browser !== undefined)
+		return refuse('a pure script job cannot use a browser grant; remove permissions.browser')
 	const checked = checkPermissions(host, input.permissions as NonNullable<Input['permissions']>)
 	if (!checked.ok) return refuse(checked.error)
 	const permissions = checked.permissions
 	const draft: ScheduleJobDraft = {
 		name: input.name as string,
-		prompt: input.prompt as string,
 		when: input.when as string,
+		...(runKind !== 'agent' ? { runKind } : {}),
+		...(input.script ? { script: input.script } : {}),
+		...(input.prompt !== undefined ? { prompt: input.prompt } : {}),
 		...(input.folder !== undefined ? { folder: input.folder } : {}),
 		...(input.tz !== undefined ? { tz: input.tz } : {}),
 		permissions,
@@ -302,7 +350,9 @@ async function create(
 	const said =
 		answer === 'create-paused'
 			? `Job "${created.name}" was created paused. The operator can resume it with /schedule.`
-			: `Job "${created.name}" was created. It runs ${preview.schedule}, with nobody watching; results arrive as a notification and a session.`
+			: runKind === 'script'
+				? `Job "${created.name}" was created. It runs ${preview.schedule}, with nobody watching; results are recorded in its history and may arrive as a notification. It creates no session.`
+				: `Job "${created.name}" was created. It runs ${preview.schedule}, with nobody watching; results arrive as a notification and a session.`
 	return {
 		success: true,
 		output: created.note ? `${said} ${created.note}` : said,
@@ -311,7 +361,12 @@ async function create(
 }
 
 async function list(host: ScheduleToolHost, input: Input): Promise<ToolResult> {
-	const jobs = await host.list({ allFolders: input.allFolders === true })
+	let jobs: readonly ScheduleJobSummary[]
+	try {
+		jobs = await host.list({ allFolders: input.allFolders === true })
+	} catch (error) {
+		return refuse(error instanceof Error ? error.message : String(error))
+	}
 	if (jobs.length === 0) return { success: true, output: 'No scheduled jobs.', data: { jobs: [] } }
 	const lines = jobs.map(
 		(j) =>
@@ -321,7 +376,16 @@ async function list(host: ScheduleToolHost, input: Input): Promise<ToolResult> {
 }
 
 /** The fields `update` may change, as the model set them. */
-const CHANGEABLE = ['prompt', 'when', 'folder', 'tz', 'permissions', 'budget'] as const
+const CHANGEABLE = [
+	'prompt',
+	'when',
+	'folder',
+	'tz',
+	'permissions',
+	'budget',
+	'kind',
+	'script',
+] as const
 
 async function update(
 	host: ScheduleToolHost,
@@ -343,12 +407,31 @@ async function update(
 	if (given.length === 0) {
 		return refuse(`update needs at least one of ${CHANGEABLE.join(', ')} to change.`)
 	}
+	if (input.kind === 'agent' && input.script !== undefined) {
+		return refuse(
+			'update cannot set kind to agent while also giving a script; drop script to make it an agent job, or leave kind unset (or as script/script+agent) to keep one.',
+		)
+	}
 	let permissions: ScheduleJobDraft['permissions'] | undefined
 	if (input.permissions) {
 		const checked = checkPermissions(host, input.permissions)
 		if (!checked.ok) return refuse(checked.error)
 		permissions = checked.permissions
-		if (networkWithHostShell({ name: '', prompt: '', when: '', permissions }))
+		// The same guard `create` applies, against whatever THIS call
+		// changes: a kind given here is read too, since a script/script+agent
+		// job is refused this combination even where an agent job is not (no
+		// live turn reviews a script's calls one at a time). A kind changed
+		// with the existing permissions is checked on the effective preview
+		// after the host has applied all changes below.
+		if (
+			networkWithHostShell({
+				name: '',
+				prompt: '',
+				when: '',
+				...(input.kind !== undefined ? { runKind: input.kind } : {}),
+				permissions,
+			})
+		)
 			return refuse(NETWORK_WITH_HOST_SHELL)
 	}
 	const changes: ScheduleJobChanges = {
@@ -358,6 +441,8 @@ async function update(
 		...(input.tz !== undefined ? { tz: input.tz } : {}),
 		...(permissions ? { permissions } : {}),
 		...(input.budget ? { budget: input.budget } : {}),
+		...(input.kind !== undefined ? { runKind: input.kind } : {}),
+		...(input.script !== undefined ? { script: input.script } : {}),
 	}
 	let proposal: ScheduleJobUpdateProposal
 	try {
@@ -365,6 +450,14 @@ async function update(
 	} catch (error) {
 		return refuse(error instanceof Error ? error.message : String(error))
 	}
+	const effectiveKind = input.kind ?? proposal.preview.runKind ?? 'agent'
+	if (
+		(effectiveKind === 'script' || effectiveKind === 'script+agent') &&
+		proposal.preview.execution === 'host' &&
+		(proposal.preview.networkGrantAccess ?? proposal.preview.networkAccess)
+	) {
+		return refuse(NETWORK_WITH_HOST_SHELL)
+	}
 	let confirmed = false
 	try {
 		confirmed = await host.confirmUpdate(
@@ -450,7 +543,7 @@ export function buildScheduleTools(host: ScheduleToolHost): ToolDefinition[] {
 		defineTool({
 			name: SCHEDULE_TOOL_NAME,
 			description:
-				"Manage the operator's scheduled jobs: prompts that run later in a folder, with nobody watching, under an explicit permission set. Use it only when the user asks for something to happen on a schedule. create, update, resume and delete are confirmed by the operator; pause is not. A job needs name, prompt, when and permissions (unmatched: park or deny, plus a preset, rules or a browser grant). To change a job, update it with job and only the fields that change; do not delete and recreate it. Leave every other field (folder, tz, execution, budget, headed) unset unless the user asked for it: the defaults are the operator's, and the confirmation marks each value you chose. Scheduled runs cannot ask questions.",
+				"Manage the operator's scheduled jobs: model prompts or fixed scripts that run later in a folder, with nobody watching, under an explicit permission set. Use it only when the user asks for something to happen on a schedule. create, update, resume and delete are confirmed by the operator; pause is not. A job needs name, when and permissions (unmatched: park or deny, plus a preset, rules or a browser grant). agent and script+agent also need prompt; script and script+agent also need script. A pure script has no prompt, model, agent budget, browser grant or session; set script.timeoutMs to limit it. To change a job, update it with job and only the fields that change; do not delete and recreate it. Leave every other field (folder, tz, execution, budget, headed) unset unless the user asked for it: the defaults are the operator's, and the confirmation marks each value you chose. Scheduled runs cannot ask questions.",
 			inputSchema,
 			category: 'custom',
 			permissions: [],

package/src/tools/schedules/types.ts

@@ -11,10 +11,29 @@
 /** A rule effect, in the vocabulary of the CLI's `[permissions]` table. */
 export type ScheduleRuleEffect = 'allow' | 'ask' | 'deny'
 
-/** What the model proposes. Validated by the tool's schema, then by the host. */
+/**
+ * What the model proposes. Validated by the tool's schema, then by the host.
+ *
+ * `runKind` absent means `'agent'`, unchanged from before this field
+ * existed — every existing host keeps compiling and behaving the same.
+ * `prompt` is optional ONLY because a pure `'script'` draft has none; a
+ * `ScheduleToolHost` that read it as a bare `string` before this field
+ * existed now needs a null check under `strictNullChecks` (see the SDK's
+ * changeset for this release: this is a breaking change to the type, not a
+ * free widening).
+ */
 export interface ScheduleJobDraft {
 	readonly name: string
-	readonly prompt: string
+	/** Required unless `runKind` is `'script'`, whose prompt is unused. */
+	readonly prompt?: string
+	/** Absent: `'agent'`. */
+	readonly runKind?: 'agent' | 'script' | 'script+agent'
+	/** Required when `runKind` is `'script'` or `'script+agent'` (the wake-gate). */
+	readonly script?: {
+		readonly body: string
+		readonly shell: 'bash' | 'sh'
+		readonly timeoutMs?: number
+	}
 	/** Schedule words: `every 30m`, `0 9 * * 1-5`, `at 09:00`, `in 2h`. */
 	readonly when: string
 	/** Folder the job runs in. Absent: the session's working directory. */
@@ -78,7 +97,16 @@ export interface ScheduleJobPreview {
 	readonly folder: string
 	/** True when `folder` is outside the session's working directory and added directories. */
 	readonly outsideSessionRoots: boolean
+	/** Empty for a pure `'script'` job, whose prompt is unused. */
 	readonly prompt: string
+	/** Absent: `'agent'`. */
+	readonly runKind?: 'agent' | 'script' | 'script+agent'
+	/** Present for `runKind: 'script'`/`'script+agent'`: the exact confirmed text. */
+	readonly script?: {
+		readonly body: string
+		readonly shell: 'bash' | 'sh'
+		readonly timeoutMs: number
+	}
 	/** The schedule in words, with its zone. */
 	readonly schedule: string
 	/** The next fire times, ISO-8601 UTC. */
@@ -87,8 +115,11 @@ export interface ScheduleJobPreview {
 	readonly rules: readonly string[]
 	readonly unmatched: 'park' | 'deny' | 'allow'
 	readonly execution: 'host' | 'sandbox'
-	/** A rule lets the run reach the network. */
+	/** The run can reach the network, including through a fixed host script. */
 	readonly networkAccess: boolean
+	/** Web/browser permissions grant network access, separate from a script's own capability. */
+	readonly networkGrantAccess?: boolean
+	/** Effective run limits. A pure script has zero model iterations/tokens and its script timeout. */
 	readonly budget: {
 		readonly maxIterations: number
 		readonly tokenBudget: number
@@ -96,8 +127,8 @@ export interface ScheduleJobPreview {
 	}
 	/** Runs per day at most, times the token budget. Absent for a one-shot. */
 	readonly dailyTokenCeiling?: number
-	/** Provider and model the job is pinned to. */
-	readonly model: string
+	/** Provider and model the agent phase is pinned to. Absent for a pure script job. */
+	readonly model?: string
 	/** Where the run's credential comes from, in words. */
 	readonly credentialSource?: string
 	/** Anything the host wants said in the warning colour. */
@@ -135,6 +166,20 @@ export interface ScheduleJobChanges {
 	readonly tz?: string
 	readonly permissions?: ScheduleJobDraft['permissions']
 	readonly budget?: ScheduleJobDraft['budget']
+	/**
+	 * Changes what kind of run this is. Absent: keeps the job's current kind.
+	 * Moving to `'script'`/`'script+agent'` needs `script`; moving to
+	 * `'agent'` drops whatever script the job had, whether or not one is
+	 * given here — an agent job cannot carry one.
+	 */
+	readonly runKind?: 'agent' | 'script' | 'script+agent'
+	/**
+	 * Replaces the whole script (or, for `'script+agent'`, wake-gate) body,
+	 * shell and timeout — never a partial edit of just one of them. Absent:
+	 * keeps the job's current script. Re-verified fresh against the
+	 * scheduled-run floor and every `deny` rule, the same as a new job's.
+	 */
+	readonly script?: ScheduleJobDraft['script']
 }
 
 /** A proposed change to a job, as the host computed it. */
@@ -205,7 +250,8 @@ export interface ScheduleToolHost {
 	 * folder's; a host may list every job regardless, marking the session
 	 * folder's with {@link ScheduleJobSummary.inSessionFolder}. The tool says
 	 * "No scheduled jobs." when this returns none, so a host that filters
-	 * says so only for its folder.
+	 * says so only for its folder. Throw on an unreadable job store: the tool
+	 * reports the error rather than claiming there are no jobs.
 	 */
 	list(options: { readonly allFolders: boolean }): Promise<readonly ScheduleJobSummary[]>
 	/** A job by name or id prefix, or undefined. */

package/src/tools/trusted-read-only.ts

@@ -1,3 +1,4 @@
+import type { ToolSourceRef } from '../toolsets/types.js'
 import type { ToolDefinition } from '../types/tool/index.js'
 
 /**
@@ -30,23 +31,31 @@ import type { ToolDefinition } from '../types/tool/index.js'
  *    opening its own gate.
  *
  * Trust for the second case comes from the operator, per server, and is
- * recorded on the tool as `provenance.readOnlyHintTrusted`. Never a global
- * switch: one flag meaning "trust annotations" hands every connected
- * server the same reach, which is the hole restated.
+ * carried on the OWNING TOOLSET's source (`ToolSourceRef.readOnlyHintTrusted`,
+ * `toolsets/manager.ts`'s `sourceOf`) rather than stamped onto the tool
+ * itself — `ToolDefinition` has no `provenance` field to read; a definition
+ * cannot claim its own source. Never a global switch: one flag meaning
+ * "trust annotations" hands every connected server the same reach, which is
+ * the hole restated.
  *
  * `isReadOnly` itself is left reporting faithfully what the server said.
- * Provenance and policy are different questions, and collapsing them would
+ * Source and policy are different questions, and collapsing them would
  * corrupt the outbound re-export and the prompt's own destructive label in
  * order to fix a gate.
  */
-export function isTrustedReadOnly(tool: ToolDefinition | undefined, input: unknown): boolean {
+export function isTrustedReadOnly(
+	tool: ToolDefinition | undefined,
+	input: unknown,
+	source?: ToolSourceRef,
+): boolean {
 	if (!tool?.isReadOnly) return false
 
-	// No provenance means the tool is host-defined: it came from this
-	// process, from code the operator installed, and there is no untrusted
-	// party in the chain. Requiring an opt-in for a builtin would break
-	// every read-only exemption for no gain in trust.
-	if (tool.provenance && !tool.provenance.readOnlyHintTrusted) return false
+	// A source that is not `mcp_server` is host-defined: this process, code
+	// the operator installed, no untrusted party in the chain. Requiring an
+	// opt-in for a builtin would break every read-only exemption for no gain
+	// in trust. `source` itself absent (a caller with no manager to ask)
+	// is treated the same way, matching the old "no provenance" default.
+	if (source?.kind === 'mcp_server' && !source.readOnlyHintTrusted) return false
 
 	return tool.isReadOnly(input)
 }