@open-everywhere/core 0.1.0

package/dist/agent/tools/cancel_routine.js

@@ -0,0 +1,123 @@
+// cancel_routine PROPOSES stopping a routine on this surface by its id. Cancelling REMOVES a standing behaviour the surface relies on, and an injected turn that silently cancels the watch guarding a system is the mirror of an injected create — so this validates and freezes the exact routine id and its trigger description, posts a card, and the durable removal happens on a human's click. The dispatcher's own self-disable of broken routines is a separate path, unattended by design.
+// 🔴 A FIRE CANNOT PROPOSE ONE: the gate below asks for the ACTING principal, so it is unsatisfiable inside a triggered fire. The card is not a sufficient control on its own — a card's persuasive weight is the human NAME on its "asked by" line, and a fire binds as its routine's creator, so "Alice asked to stop the security watch" is a far better pretext for a wrong click than any machine identity. Nothing legitimate loses a verb: a routine that should stop firing self-disables host-side, a finished job completes itself, and a failing run declares its failure.
+import { defineTool } from "eve/tools";
+import { never } from "eve/tools/approval";
+import { z } from "zod";
+import { bindFrom } from "../identity/binding.js";
+import { actingPrincipalIdOf, unattendedOf } from "../access/request.js";
+import { resolvePartition } from "../memory/partition.js";
+import { proposalScopeKey } from "../channels/propose-scope.js";
+import { getRoutine } from "../routines/store.js";
+import { describeTrigger } from "../routines/routine.js";
+import { untrustedIngestedThisTurn } from "../access/taint-signal.js";
+import { requestApproval, autoApprovedNote } from "../approvals/flow.js";
+import { approvalPostDeps } from "./set_spend_limit.js";
+import { checkApprovalVenue, describeVenueRefusal, cardPostedPrefix, cardPostedTail } from "../approvals/card-venue.js";
+import { getConfig } from "../access/config.js";
+import { requireSessionContinuation } from "../spend/checkpoint.js";
+export default defineTool({
+    description: "PROPOSE cancelling (deleting) a routine on this surface by its id. Get the id from list_routines. Use when asked to stop a scheduled job, watch, or subscription. This does NOT cancel on the spot: an approval card posts naming the exact routine, and it's removed only when a human confirms (cancelling removes a guardrail, so it's gated). The posted card IS the reply — do not add narration after this call. EXCEPT when this surface can't host a card: it then goes to a card-capable channel in the same domain, the `message` field names it, and you MUST relay that.",
+    inputSchema: z.object({
+        id: z.string().min(1).describe("The routine id, e.g. 'r-1a2b3c4d' (from list_routines)."),
+    }),
+    outputSchema: z.object({
+        // Gated: nothing is cancelled yet — an approval card was posted for a human to confirm.
+        pending: z.boolean(),
+        pendingId: z.string().optional(),
+        id: z.string(),
+        message: z.string(),
+        autoApproved: z.boolean().optional().describe("The approver chain lowered this verb: no card was posted and it has ALREADY run."),
+    }),
+    approval: never(),
+    async execute(input, ctx) {
+        // SOFT session cost checkpoint (OPE-62) — pause consequential work past a configured
+        // per-session threshold until a member confirms; no-op when unconfigured.
+        await requireSessionContinuation(ctx, "cancel_routine");
+        const p = resolvePartition(ctx);
+        // 🔴 THE ROOM THAT ASKED, NOT THE ROOM THAT ARRIVED LAST (OPE-1756). `p` above is the TURN's
+        // partition, and a turn that merged queued deliveries carries only the LAST delivery's auth —
+        // so on a turn answering two rooms it names the wrong one. The GOVERNED scope follows the
+        // ADDRESSED wake instead, through the same road the reply path uses; it falls back to `p` on
+        // every unknown, so a single-wake turn is unchanged.
+        // 🔴 THE MERGE ROAD IS UNREACHABLE ON eve 0.54.3; THIS READ IS STILL LIVE (OPE-2042). eve batches
+        // adjacent queued deliveries only when their full auth contexts match, and OE stamps a fresh
+        // per-delivery `oe_delivery_id` into `auth.attributes`, so two auth-carrying deliveries on one
+        // unified window never compare equal; only the caller-less task COMPLETION COHORT still folds,
+        // and it carries no `auth` at all. But the TURN's ctx names the wrong room WITHOUT any merge
+        // too: a turn woken by an INTERNAL wake — an approval decision, a completion — answers a
+        // conversation whose envelope is in the seat's shared context, through the reply fence's
+        // same-conversation and pending arms (`channels/unified-window.ts` `resolveAnswerableReplyTarget`,
+        // arms 3 and 4). Measured in production on 2026-08-15 (`docs/glossary.md`). So this read is
+        // LOAD-BEARING, not defensive. `scripts/coalesced-delivery-merge-assumption-test.ts` pins only
+        // the merge road's impossibility.
+        // 🔴 WHAT MOVES IS THE GOVERNANCE KEY ONLY. Anything else this tool derives from `p` — the memory
+        // tier, the card's venue walk, and any surface key frozen into the proposal's own `args` — keeps
+        // reading the TURN's partition, deliberately: those name what the act DOES and where this seat
+        // lives, while the scope key names who may approve it and which halt covers it. Moving the act's
+        // own target is a design choice this task does not hold.
+        const proposeScopeKey = await proposalScopeKey(ctx, p);
+        const id = input.id.trim();
+        // Load the routine now: it confirms the routine exists, and it FREEZES its trigger description onto the card, so the target is the real routine rather than something re-derived from model-visible state at click time.
+        const routine = await getRoutine(p.org, p.surfaceKey, id);
+        if (!routine) {
+            throw new Error(`No routine '${id}' on this surface — check the id with list_routines.`);
+        }
+        const description = describeTrigger(routine.trigger, routine.report);
+        // GATE (2026-07-11). Freeze (surfaceKey, id, description) and post an approval card; a
+        // human on the surface confirms the removal with a click (routine.cancel ActionKind does
+        // the removeRoutine). Same fail-closed gates as create_routine.
+        const binding = bindFrom(ctx);
+        // 🔴 THE ACTING principal (identity/binding.ts actingPrincipalId), never the bound one — see the
+        // header. `principalIdOf` here would be satisfied by a fire's attested creator, which is exactly
+        // the name that makes the card persuasive.
+        // principal-gate: presence — a card's persuasive weight IS the human name on it, so a fire proposing a
+        // cancellation would put a real person's name on a request they never made (OPE-272).
+        const requestedBy = actingPrincipalIdOf(ctx);
+        if (!requestedBy) {
+            throw new Error("cancel_routine needs a verified sender to gate the removal — a triggered routine fire has no acting sender (only the creator it is attributed to), and a fire may not propose removing a standing behaviour. Ask a person in this conversation to cancel it.");
+        }
+        // Where the card goes: this room when it can host one, otherwise a card-capable channel in the SAME domain.
+        // This also subsumes the old "couldn't resolve this channel's id" throw — a missing channelId on a card-capable surface simply means no own-room venue, which the walk reports precisely.
+        const venueResult = await checkApprovalVenue(binding, p, () => getConfig().loadDomains());
+        if ("refusal" in venueResult) {
+            throw new Error(describeVenueRefusal(venueResult.refusal, binding.platform, "cancel that routine"));
+        }
+        const venue = venueResult.venue;
+        // The proposing turn's taint, carried onto the card exactly as the edit and create verbs carry theirs.
+        // A REMOVAL is the direction that needs it most: an injected turn's likeliest ask is not "add a behaviour I can be seen arming" but "quietly stop the watch that would have noticed me".
+        const tainted = untrustedIngestedThisTurn();
+        const posted = await requestApproval({
+            org: p.org,
+            kind: "routine.cancel",
+            args: { org: p.org, partition: p, surfaceKey: p.surfaceKey, id, description, requestedBy, tainted },
+            scopeKey: proposeScopeKey,
+            domain: null,
+            requestedBy,
+            channelId: venue.channelId,
+            threadTs: venue.sameRoom ? binding.threadTs ?? null : null,
+            // Mint-frozen proposing-surface identity (task #105) — the TTL sweep's feedback target,
+            // and the VENUE's key because that is where the card actually is.
+            postedTo: venue.surfaceKey,
+            chain: { unattended: unattendedOf(ctx) },
+        }, approvalPostDeps(venue.platform, ctx));
+        // The chain can LOWER this verb (OPE-296): then no card exists and the cancel already ran, so
+        // the pending-voiced text below would be a lie. One subject phrase, two honest endings.
+        const subject = `cancel of routine ${id} (${description})${tainted ? " ⚠ tainted" : ""}`;
+        if (posted.autoApproved) {
+            return {
+                pending: false,
+                autoApproved: true,
+                pendingId: posted.id,
+                id,
+                message: autoApprovedNote(subject, posted.autoApproved),
+            };
+        }
+        return {
+            pending: true,
+            pendingId: posted.id,
+            id,
+            message: `${cardPostedPrefix(venue)} — ${subject} awaiting a human to confirm (pending ${posted.id}).${cardPostedTail(venue, "confirm the cancellation", posted)}`,
+        };
+    },
+});
+//# sourceMappingURL=cancel_routine.js.map

package/dist/agent/tools/cancel_routine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cancel_routine.js","sourceRoot":"","sources":["../../../agent/tools/cancel_routine.ts"],"names":[],"mappings":"AAAA,qeAAqe;AACre,sjBAAsjB;AAEtjB,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACxH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpE,eAAe,UAAU,CAAC;IACxB,WAAW,EACT,sjBAAsjB;IACxjB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,yDAAyD,CAAC;KAC1F,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,wFAAwF;QACxF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kFAAkF,CAAC;KAClI,CAAC;IACF,QAAQ,EAAE,KAAK,EAAE;IACjB,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,qFAAqF;QACrF,0EAA0E;QAC1E,MAAM,0BAA0B,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAChC,6FAA6F;QAC7F,8FAA8F;QAC9F,0FAA0F;QAC1F,6FAA6F;QAC7F,qDAAqD;QACrD,kGAAkG;QAClG,6FAA6F;QAC7F,+FAA+F;QAC/F,+FAA+F;QAC/F,6FAA6F;QAC7F,yFAAyF;QACzF,yFAAyF;QACzF,mGAAmG;QACnG,4FAA4F;QAC5F,+FAA+F;QAC/F,kCAAkC;QAClC,kGAAkG;QAClG,iGAAiG;QACjG,+FAA+F;QAC/F,iGAAiG;QACjG,yDAAyD;QACzD,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAE3B,yNAAyN;QACzN,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE,sDAAsD,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAErE,uFAAuF;QACvF,yFAAyF;QACzF,gEAAgE;QAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9B,iGAAiG;QACjG,iGAAiG;QACjG,2CAA2C;QAC3C,uGAAuG;QACvG,sFAAsF;QACtF,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,8PAA8P,CAAC,CAAC;QAClR,CAAC;QAED,4GAA4G;QAC5G,0LAA0L;QAC1L,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1F,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;QAEhC,uGAAuG;QACvG,yLAAyL;QACzL,MAAM,OAAO,GAAG,yBAAyB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC;YACE,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE;YACnG,QAAQ,EAAE,eAAe;YACzB,MAAM,EAAE,IAAI;YACZ,WAAW;YACX,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;YAC1D,wFAAwF;YACxF,kEAAkE;YAClE,QAAQ,EAAE,KAAK,CAAC,UAAU;YAC1B,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE;SACzC,EACD,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CACtC,CAAC;QAEF,8FAA8F;QAC9F,wFAAwF;QACxF,MAAM,OAAO,GAAG,qBAAqB,EAAE,KAAK,WAAW,IAAI,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACzF,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,MAAM,CAAC,EAAE;gBACpB,EAAE;gBACF,OAAO,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;aACxD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,MAAM,CAAC,EAAE;YACpB,EAAE;YACF,OAAO,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,OAAO,yCAAyC,MAAM,CAAC,EAAE,KAAK,cAAc,CAAC,KAAK,EAAE,0BAA0B,EAAE,MAAM,CAAC,EAAE;SACnK,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/dist/agent/tools/capture_events.d.ts

@@ -0,0 +1,17 @@
+declare const _default: import("eve/tools").ToolDefinition<{
+    source: string;
+    minutes?: number | undefined;
+}, {
+    ok: boolean;
+    message: string;
+}> & {
+    execute(input: {
+        source: string;
+        minutes?: number | undefined;
+    }, ctx: import("eve/tools").ToolContext): Promise<{
+        ok: boolean;
+        message: string;
+    }>;
+};
+export default _default;
+//# sourceMappingURL=capture_events.d.ts.map

package/dist/agent/tools/capture_events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture_events.d.ts","sourceRoot":"","sources":["../../../agent/tools/capture_events.ts"],"names":[],"mappings":""}

package/dist/agent/tools/capture_events.js

@@ -0,0 +1,51 @@
+// capture_events opens a BOUNDED window in which a webhook's deliveries are retained, so a filter can be written against real traffic. ⭐ This is the ONLY way capture ever turns on: there is no default window, and creating a hook does not open one, because creation is not consent to retention — a hook nobody runs this on retains nothing, forever, which is why the feature can exist at all.
+// What is retained is NOT the payload body but the jq filter document. Headers never enter it, so a captured row cannot hold a signature or a bearer token, and the rendered summary never enters it, so no attacker-authored prose is retained — structural, rather than a redaction step someone could forget to run. Bounded three ways in code (row count, wall-clock however long a caller asks for, and an absolute retention sweep), and REFUSED by name for `trigger-only` hooks, whose whole purpose is keeping payloads away from humans.
+// Arming is audited, and the principal is passed from here: for the one verb in the tree that starts retaining a third party's bytes, "who turned this on" is the question the record exists to answer.
+import { defineTool } from "eve/tools";
+import { z } from "zod";
+import { principalIdOf } from "../access/request.js";
+import { resolvePartition } from "../memory/partition.js";
+import { armCaptureWindow } from "../control/capture-window-read.js";
+import { CAPTURE_MAX_DELIVERIES, CAPTURE_MAX_WINDOW_MS } from "../operational/store.js";
+export default defineTool({
+    description: "Turn on temporary recording of a webhook's incoming deliveries so their shape can be inspected with list_recent_events and a subscription filter written against real traffic. Use when someone wants a routine to fire on only some of a webhook's events and nobody knows what the sender's payload looks like. Recording is OFF until this is run, stops automatically, and keeps only a bounded number of recent deliveries. Refused for trigger-only webhooks, whose payloads are never retained by design.",
+    inputSchema: z.object({
+        source: z.string().min(1).describe("The webhook's source handle, e.g. 'deploy-status' (from list_webhooks)."),
+        minutes: z
+            .number()
+            .int()
+            .positive()
+            .optional()
+            .describe(`How long to record for. Defaults to 15 and is capped at ${Math.round(CAPTURE_MAX_WINDOW_MS / 60_000)}.`),
+    }),
+    outputSchema: z.object({
+        ok: z.boolean(),
+        message: z.string(),
+    }),
+    async execute(input, ctx) {
+        const partition = resolvePartition(ctx);
+        // The BOUND principal, not the acting one: this is provenance for a record, not a gate. On a
+        // routine fire that resolves to the routine's attested creator, which is the right answer here —
+        // somebody nameable armed the retention, even if not in the room at the time — whereas the
+        // acting principal would be `undefined` and the row would go back to saying "unknown".
+        const armedBy = principalIdOf(ctx);
+        const result = await armCaptureWindow({
+            partition,
+            source: input.source,
+            ...(armedBy !== undefined ? { armedBy } : {}),
+            ...(input.minutes !== undefined ? { windowMs: input.minutes * 60_000 } : {}),
+        });
+        if (!result.ok)
+            return { ok: false, message: result.message };
+        return {
+            ok: true,
+            message: `Recording deliveries to "${input.source}" until ${result.until}, or until ${CAPTURE_MAX_DELIVERIES} have arrived — ` +
+                "whichever comes first. Any previously captured deliveries for this webhook were cleared, so the numbering starts at 1. " +
+                "Run list_recent_events once some have landed.",
+        };
+    },
+    // NO `toModelOutput` — every string this tool returns is host-composed (the handle came from our
+    // own store, the rest is this file's own copy). Nothing an outside party wrote passes through it,
+    // so there is nothing to fence, and fencing host copy would teach the model to discount it.
+});
+//# sourceMappingURL=capture_events.js.map

package/dist/agent/tools/capture_events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture_events.js","sourceRoot":"","sources":["../../../agent/tools/capture_events.ts"],"names":[],"mappings":"AAAA,uYAAuY;AACvY,ohBAAohB;AAEphB,wMAAwM;AAExM,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAExF,eAAe,UAAU,CAAC;IACxB,WAAW,EACT,kfAAkf;IACpf,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,yEAAyE,CAAC;QAC7G,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,EAAE;aACV,QAAQ,CAAC,2DAA2D,IAAI,CAAC,KAAK,CAAC,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAC;KACtH,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;QACf,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;KACpB,CAAC;IACF,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxC,6FAA6F;QAC7F,iGAAiG;QACjG,2FAA2F;QAC3F,uFAAuF;QACvF,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;YACpC,SAAS;YACT,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7E,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9D,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EACL,4BAA4B,KAAK,CAAC,MAAM,WAAW,MAAM,CAAC,KAAK,cAAc,sBAAsB,kBAAkB;gBACrH,yHAAyH;gBACzH,+CAA+C;SAClD,CAAC;IACJ,CAAC;IACD,iGAAiG;IACjG,kGAAkG;IAClG,4FAA4F;CAC7F,CAAC,CAAC"}

package/dist/agent/tools/check_pr_status.d.ts

@@ -0,0 +1,52 @@
+export declare const checkPrStatusEntry: import("eve/tools").ToolDefinition<{
+    repo: string;
+    number: number;
+}, {
+    url: string;
+    title: string;
+    state: "closed" | "open";
+    merged: boolean;
+    draft: boolean;
+    updatedAt: string;
+    summary: string;
+}> & {
+    execute(input: {
+        repo: string;
+        number: number;
+    }, ctx: import("eve/tools").ToolContext): Promise<{
+        url: string;
+        title: string;
+        state: "closed" | "open";
+        merged: boolean;
+        draft: boolean;
+        updatedAt: string;
+        summary: string;
+    }>;
+};
+declare const _default: import("eve/tools").DynamicSentinel<(import("eve/tools").ToolDefinition<{
+    repo: string;
+    number: number;
+}, {
+    url: string;
+    title: string;
+    state: "closed" | "open";
+    merged: boolean;
+    draft: boolean;
+    updatedAt: string;
+    summary: string;
+}> & {
+    execute(input: {
+        repo: string;
+        number: number;
+    }, ctx: import("eve/tools").ToolContext): Promise<{
+        url: string;
+        title: string;
+        state: "closed" | "open";
+        merged: boolean;
+        draft: boolean;
+        updatedAt: string;
+        summary: string;
+    }>;
+}) | null>;
+export default _default;
+//# sourceMappingURL=check_pr_status.d.ts.map

package/dist/agent/tools/check_pr_status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check_pr_status.d.ts","sourceRoot":"","sources":["../../../agent/tools/check_pr_status.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;CA6C7B,CAAC"}

package/dist/agent/tools/check_pr_status.js

@@ -0,0 +1,66 @@
+// Read-only GitHub PR status lookup — the primitive the PR-subscription re-arm loop calls on every fire to see what changed since the baseline in its prompt, and useful directly on its own.
+// Mounted on the REPO GRANT: a session whose scope grants no repo cannot name a PR this tool would accept, so it does not see the tool at all. The grant check at execute stays the authoritative wall. The tool needs no APPROVAL at any grain, being a genuine read, so the grant rides a bare `session.started` resolver rather than the window gate.
+// It does pass the ACTING-IDENTITY gate (scm/github-acting-identity.ts), which is a different question: not "may this session read" but "whose account may answer". A read is exactly where that question bites, because the two identities see different repositories.
+import { defineDynamic, defineTool } from "eve/tools";
+import { z } from "zod";
+import { resolveAccessFor } from "../access/request.js";
+import { preRegisterDynamicEntry } from "../access/window-gated.js";
+import { repoAllowed } from "../scm/provider.js";
+import { githubWorkMount } from "../scm/github-work.js";
+import { assertGithubActingIdentity } from "../scm/github-acting-identity.js";
+import { fetchPullRequestStatus, describePrStatus, resolveReadToken } from "../scm/pr-status.js";
+// FACTORED, never an inline literal in the resolver body: eve's build transform rewrites an inline
+// `defineTool` inside a `defineDynamic` handler onto a global build-order counter (the hazard
+// scripts/dynamic-tool-replay-test.ts §1 pins). A top-level const stays on the deterministic path.
+export const checkPrStatusEntry = defineTool({
+    description: "Look up the current status of a GitHub pull request — open/closed/merged, draft, title, last updated. Read-only, no approval needed. Use this to check on a PR directly, or to re-check one you're watching via a pr-subscription routine (subscribe_pr).",
+    inputSchema: z.object({
+        repo: z.string().describe("Repository as 'owner/repo'."),
+        number: z.number().int().positive().describe("PR number."),
+    }),
+    outputSchema: z.object({
+        url: z.string(),
+        title: z.string(),
+        state: z.enum(["open", "closed"]),
+        merged: z.boolean(),
+        draft: z.boolean(),
+        updatedAt: z.string(),
+        summary: z.string().describe("One-line human summary — the format the subscription baseline uses."),
+    }),
+    // NO `approval:` — a dynamic-tool approval fn only registers at resolve time, so a resumed
+    // session's replay lookup fails and eve kills the turn (the pin read_notion_page carries).
+    // Read-only, so an absent approval is the same answer `never()` gave.
+    async execute(input, ctx) {
+        const access = resolveAccessFor(ctx);
+        if (!repoAllowed(input.repo, access.repos)) {
+            throw new Error(`repo "${input.repo}" is not granted to this channel. Allowed: ${access.repos.length ? access.repos.join(", ") : "(none)"}. ` +
+                `Grant it via a bundle's repos (see agent/access/bundles.ts).`);
+        }
+        // 🔴 THE ACTING-IDENTITY GATE RUNS AFTER THE REPO FENCE AND BEFORE THE TOKEN (OPE-1642). The
+        // fence answers "may this session read this repository at all"; the gate answers "whose account
+        // may answer it". Running it first would write a `connector.acting_identity` row for a repository
+        // this session may not name. Running it after `resolveReadToken` would mint an installation token
+        // for a read the gate is about to refuse. The same order `github-read.ts`'s `admitContainer` uses.
+        await assertGithubActingIdentity(ctx, "check_pr_status");
+        const token = await resolveReadToken(input.repo);
+        const status = await fetchPullRequestStatus({ repo: input.repo, number: input.number, token });
+        return {
+            url: status.url,
+            title: status.title,
+            state: status.state,
+            merged: status.merged,
+            draft: status.draft,
+            updatedAt: status.updatedAt,
+            summary: describePrStatus(status),
+        };
+    },
+});
+preRegisterDynamicEntry("check_pr_status", "_single", checkPrStatusEntry);
+export default defineDynamic({
+    events: {
+        // `session.started` ONLY: a session's scope cannot change mid-session, so the grant resolves once.
+        // A ROUTINE FIRE resolves it too — the fire's auth bag carries the destination's platform identity attributes, so the fired session binds the routine's real surface and reads the same repo grant the arming turn did. A fire that lost this tool would break a live PR subscription silently.
+        "session.started": (_event, ctx) => (githubWorkMount(ctx) ? checkPrStatusEntry : null),
+    },
+});
+//# sourceMappingURL=check_pr_status.js.map

package/dist/agent/tools/check_pr_status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check_pr_status.js","sourceRoot":"","sources":["../../../agent/tools/check_pr_status.ts"],"names":[],"mappings":"AAAA,8LAA8L;AAC9L,yVAAyV;AACzV,wQAAwQ;AAExQ,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEjG,mGAAmG;AACnG,8FAA8F;AAC9F,mGAAmG;AACnG,MAAM,CAAC,MAAM,kBAAkB,GAAG,UAAU,CAAC;IAC3C,WAAW,EACT,2PAA2P;IAC7P,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;QACxD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;KAC3D,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;QACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACjC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;QACnB,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;QAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qEAAqE,CAAC;KACpG,CAAC;IACF,2FAA2F;IAC3F,2FAA2F;IAC3F,sEAAsE;IACtE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,SAAS,KAAK,CAAC,IAAI,8CAA8C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI;gBAC3H,8DAA8D,CACjE,CAAC;QACJ,CAAC;QACD,6FAA6F;QAC7F,gGAAgG;QAChG,kGAAkG;QAClG,kGAAkG;QAClG,mGAAmG;QACnG,MAAM,0BAA0B,CAAC,GAAsB,EAAE,iBAAiB,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/F,OAAO;YACL,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC;SAClC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AACH,uBAAuB,CAAC,iBAAiB,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAE1E,eAAe,aAAa,CAAC;IAC3B,MAAM,EAAE;QACN,mGAAmG;QACnG,gSAAgS;QAChS,iBAAiB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAsB,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC;KAC1G;CACF,CAAC,CAAC"}

package/dist/agent/tools/checkout_repo.d.ts

@@ -0,0 +1,3 @@
+declare const _default: unknown;
+export default _default;
+//# sourceMappingURL=checkout_repo.d.ts.map

package/dist/agent/tools/checkout_repo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout_repo.d.ts","sourceRoot":"","sources":["../../../agent/tools/checkout_repo.ts"],"names":[],"mappings":""}

package/dist/agent/tools/checkout_repo.js

@@ -0,0 +1,158 @@
+// Clones one of the GRANTED repos into the sandbox on demand, and fails closed on any repo outside the resolved access bundle. After it, the agent works in the directory with bash and finishes with open_pull_request, which pushes for it.
+// The default read path is firewall-brokered: a READ-ONLY installation token covering the UNION of this session's granted repos is minted HOST-SIDE and injected as a header transform on the git hosts, so the token never enters the sandbox. Only where firewall enforcement genuinely is not available does it fall back to an in-sandbox token, redacted from any error. Not consequential — a read into the workspace with a credential that cannot write — so no approval; the gate is on the PR.
+import { defineTool } from "eve/tools";
+import { windowGated } from "../access/window-gated.js";
+import { z } from "zod";
+import { resolveAccessFor } from "../access/request.js";
+import { compileNetworkPolicy } from "../access/egress.js";
+import { resolveHeaders } from "../access/credentials.js";
+import { isEnforced } from "../access/enforcement.js";
+import { narrowByConnectorOverride } from "../access/connector-scope.js";
+import { getConfig } from "../access/config.js";
+import { resolveNetworkAccessLevel } from "../access/network-access.js";
+import { getGitHubApp, repoAllowed } from "../scm/provider.js";
+import { assertGithubActingIdentity } from "../scm/github-acting-identity.js";
+import { githubWorkMount } from "../scm/github-work.js";
+import { READ_PERMISSIONS } from "../scm/mint.js";
+import { mintGitReadBroker, mergeGitReadBroker } from "../scm/broker.js";
+import { auditBrokeredEgressPolicy } from "../scm/broker-audit.js";
+import { useSelfHostEgress, pushEgressPolicy } from "../access/self-host-egress.js";
+import { checkoutCommand, checkoutCommandBrokered, isSafeCheckoutDir, redactSecret, CHECKOUT_OK, parseConventionProbe, parseSkillsProbe, parseAgentsProbe } from "../scm/git.js";
+import { recordRepoSkills, parseRepoAgent, REPO_SKILL_SEP } from "../scm/repo-skills.js";
+export default windowGated("checkout_repo", defineTool({
+    description: "Clone one of the allowed repositories (see list_repos) into your workspace so you can read and change its code. Only granted repos can be cloned. After it returns, work in the given directory with bash — branch, edit, commit — then call open_pull_request, which pushes your branch and opens the PR after human approval (the checkout credential is read-only; plain `git push` will be rejected). If the result flags a convention file (AGENTS.md or CLAUDE.md), READ it before changing code — it carries the repo's own rules. If the result lists skills or delegation personas shipped in the repo, those become invocable skills from your next turn.",
+    inputSchema: z.object({
+        repo: z.string().describe("owner/repo, exactly as shown by list_repos."),
+        dir: z.string().optional().describe("workspace-relative checkout directory (default: the repo name)."),
+    }),
+    outputSchema: z.object({
+        ok: z.boolean(),
+        dir: z.string(),
+        message: z.string(),
+        // Present only if the repo root has an AGENTS.md/CLAUDE.md — a flag, not the content
+        // (the editor reads it on demand; preloading would pollute the caller's context).
+        conventions: z
+            .object({ file: z.string(), lines: z.number(), bytes: z.number() })
+            .optional(),
+        // Present only if the repo ships skills (.agents/skills/ else .claude/skills/) —
+        // names are the namespaced `<repoSlug>--<skill>` forms the model can invoke.
+        skills: z
+            .object({ count: z.number(), names: z.array(z.string()), truncated: z.boolean() })
+            .optional(),
+        // Present only if the repo ships agent definitions (.agents/agents/ else
+        // .claude/agents/) — surfaced as delegation-persona skills, same namespacing.
+        agents: z
+            .object({ count: z.number(), names: z.array(z.string()), truncated: z.boolean() })
+            .optional(),
+    }),
+    async execute(input, ctx) {
+        const access = resolveAccessFor(ctx);
+        if (!repoAllowed(input.repo, access.repos)) {
+            throw new Error(`repo "${input.repo}" is not granted to this channel. Allowed: ${access.repos.length ? access.repos.join(", ") : "(none)"}. ` +
+                `Grant it via a bundle's repos (see agent/access/bundles.ts).`);
+        }
+        // The acting-identity gate, after the repo fence and before any credential is resolved — see
+        // check_pr_status.ts for the order. A clone is a READ of repository contents into a sandbox the
+        // model then reads, and the two acting identities reach different repositories, so "clone it
+        // with my own GitHub account" has the same wrong answer here as anywhere else.
+        await assertGithubActingIdentity(ctx, "checkout_repo");
+        const app = getGitHubApp();
+        if (!app) {
+            throw new Error("source control isn't configured (no GitHub App). Set OE_GITHUB_APP_* — see .env.example / docs/capabilities/source-control.md.");
+        }
+        const dir = input.dir ?? input.repo.split("/")[1];
+        if (!isSafeCheckoutDir(dir)) {
+            throw new Error(`invalid checkout dir "${dir}" — use a simple workspace-relative path.`);
+        }
+        const owner = input.repo.slice(0, input.repo.indexOf("/"));
+        const noInstallationError = () => new Error(`repo "${input.repo}": its owner has no linked GitHub App installation. ` +
+            `Install the Open Everywhere GitHub App on that org (see docs/capabilities/source-control.md).`);
+        const sandbox = await ctx.getSandbox();
+        let result;
+        if (isEnforced()) {
+            // Firewall-brokered read, the default: mint the UNION of this session's granted repos rather than just this one, and merge the owner-scoped rule into the STANDING policy — recompiled fresh here rather than reused from cache, so a config change since session start is honoured and the bare github allow is replaced rather than duplicated.
+            // Re-applied on every call to this tool, because these tokens live about an hour, so a per-call re-mint IS the refresh. It threads the same override-narrowing dep and the resolved network-access level the egress hook passes, so a mid-session break-glass revoke or a widened scope is not silently dropped.
+            const basePolicy = await compileNetworkPolicy(access, resolveHeaders, (ids) => narrowByConnectorOverride(ctx, ids), resolveNetworkAccessLevel(access, getConfig().loadNetworkAccess?.() ?? []));
+            const { rulesByOwner } = await mintGitReadBroker(app, access.repos);
+            if (!rulesByOwner.has(owner))
+                throw noInstallationError();
+            const brokered = mergeGitReadBroker(basePolicy, rulesByOwner);
+            // Re-apply mid-turn through the SAME channel the session-start hook uses: push the owner-scoped broker policy to the egress proxy where one is wired, otherwise set the sandbox network policy.
+            // Fail-closed: a failed push throws and fails the checkout rather than cloning with an unenforced broker.
+            if (useSelfHostEgress()) {
+                await pushEgressPolicy(brokered);
+            }
+            else {
+                await sandbox.setNetworkPolicy(brokered);
+            }
+            // OPE-1448: the row for the policy just applied. Without it the session's only `egress.policy`
+            // row is the session-start one, whose `writeHosts` names neither git host — so the brokered
+            // write reach on github.com/codeload.github.com existed on no row at all.
+            await auditBrokeredEgressPolicy(ctx, access, brokered, "checkout_repo");
+            result = await sandbox.run({ command: checkoutCommandBrokered(input.repo, dir, app.committer()) });
+            if (!result.stdout.includes(CHECKOUT_OK)) {
+                throw new Error(`clone failed for "${input.repo}": ${(result.stderr || result.stdout || "unknown error").slice(0, 500)}`);
+            }
+        }
+        else {
+            // Firewall enforcement genuinely is not available on this backend or config, so fall back to the in-sandbox token and keep checkout working.
+            // READ-ONLY: this token is persisted into the clone's config, so it must not be able to push — the write token exists only inside the approved PR flow.
+            const { tokens, ungranted } = await app.tokensForRepos([input.repo], READ_PERMISSIONS);
+            if (ungranted.length)
+                throw noInstallationError();
+            const token = tokens.get(owner).token;
+            result = await sandbox.run({ command: checkoutCommand(input.repo, token, dir, app.committer()) });
+            if (!result.stdout.includes(CHECKOUT_OK)) {
+                // Redact the token (and its base64 form) from any git output before surfacing it.
+                throw new Error(`clone failed for "${input.repo}": ${redactSecret(result.stderr || result.stdout || "unknown error", token).slice(0, 500)}`);
+            }
+        }
+        const conventions = parseConventionProbe(result.stdout) ?? undefined;
+        const conventionNote = conventions
+            ? ` This repo has a ${conventions.file} (${conventions.lines} lines) at ${dir}/${conventions.file} — read it before changing code; it holds the repo's own rules.`
+            : "";
+        // Repo-shipped skills and agents are recorded into session state, so the scoped-skills resolver arms them, namespaced, from the next turn.
+        // Fail-soft — a state hiccup must not fail a checkout that already succeeded — and zero discoveries still record, which clears a stale slot from an earlier checkout of the same repo.
+        let skills;
+        let agents;
+        try {
+            const skillsProbe = parseSkillsProbe(result.stdout);
+            const agentsProbe = parseAgentsProbe(result.stdout);
+            const agentDefs = {};
+            for (const [basename, content] of Object.entries(agentsProbe.agents)) {
+                const def = parseRepoAgent(basename, content);
+                agentDefs[def.name] = def;
+            }
+            const slug = recordRepoSkills(input.repo, skillsProbe.skills, agentDefs);
+            if (slug) {
+                const skillNames = Object.keys(skillsProbe.skills).map((name) => `${slug}${REPO_SKILL_SEP}${name}`);
+                if (skillNames.length)
+                    skills = { count: skillNames.length, names: skillNames, truncated: skillsProbe.truncated };
+                const agentNames = Object.keys(agentDefs).map((name) => `${slug}${REPO_SKILL_SEP}${name}`);
+                if (agentNames.length)
+                    agents = { count: agentNames.length, names: agentNames, truncated: agentsProbe.truncated };
+            }
+        }
+        catch (err) {
+            console.warn(`[open-everywhere:repo-skills] failed to record skills/agents for ${input.repo}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        const skillNote = skills
+            ? ` This repo ships ${skills.count} skill(s)${skills.truncated ? " (list truncated)" : ""} — available to you from your next turn as: ${skills.names.join(", ")}.`
+            : "";
+        const agentNote = agents
+            ? ` It also ships ${agents.count} delegation persona(s)${agents.truncated ? " (list truncated)" : ""} — from your next turn, each is a skill that explains how to consult it via the agent tool: ${agents.names.join(", ")}.`
+            : "";
+        return {
+            ok: true,
+            dir,
+            conventions,
+            skills,
+            agents,
+            message: `Cloned ${input.repo} into ${dir}/ (authored commits will be ${app.committer().name}). ` +
+                `Branch and commit there, then open_pull_request — it pushes your branch and opens the PR after approval (plain git push is not authorized).${conventionNote}${skillNote}${agentNote}`,
+        };
+    },
+    // MOUNT ON THE GRANT (OPE-940), not on the grain alone: a seat whose scope grants no repo cannot
+    // clone anything, so it does not see this tool. scm/github-work.ts carries the fail-open reasoning.
+}), githubWorkMount);
+//# sourceMappingURL=checkout_repo.js.map

package/dist/agent/tools/checkout_repo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout_repo.js","sourceRoot":"","sources":["../../../agent/tools/checkout_repo.ts"],"names":[],"mappings":"AAAA,8OAA8O;AAC9O,yeAAye;AAEze,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjL,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAqB,MAAM,uBAAuB,CAAC;AAE5G,eAAe,WAAW,CAAC,eAAe,EAAE,UAAU,CAAC;IACrD,WAAW,EACT,qoBAAqoB;IACvoB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;QACxE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iEAAiE,CAAC;KACvG,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;QACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;QACf,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,qFAAqF;QACrF,kFAAkF;QAClF,WAAW,EAAE,CAAC;aACX,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;aAClE,QAAQ,EAAE;QACb,iFAAiF;QACjF,6EAA6E;QAC7E,MAAM,EAAE,CAAC;aACN,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;aACjF,QAAQ,EAAE;QACb,yEAAyE;QACzE,8EAA8E;QAC9E,MAAM,EAAE,CAAC;aACN,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;aACjF,QAAQ,EAAE;KACd,CAAC;IACF,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,SAAS,KAAK,CAAC,IAAI,8CAA8C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI;gBAC3H,8DAA8D,CACjE,CAAC;QACJ,CAAC;QACD,6FAA6F;QAC7F,gGAAgG;QAChG,6FAA6F;QAC7F,+EAA+E;QAC/E,MAAM,0BAA0B,CAAC,GAAsB,EAAE,eAAe,CAAC,CAAC;QAE1E,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,gIAAgI,CAAC,CAAC;QACpJ,CAAC;QAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,2CAA2C,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,MAAM,mBAAmB,GAAG,GAAG,EAAE,CAC/B,IAAI,KAAK,CACP,SAAS,KAAK,CAAC,IAAI,sDAAsD;YACvE,+FAA+F,CAClG,CAAC;QAEJ,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC;QACvC,IAAI,MAA+C,CAAC;QAEpD,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,kVAAkV;YAClV,iTAAiT;YACjT,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAC3C,MAAM,EACN,cAAc,EACd,CAAC,GAAG,EAAE,EAAE,CAAC,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC,EAC5C,yBAAyB,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,CAAC,CAC3E,CAAC;YACF,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YACpE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YAC1D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAC9D,gMAAgM;YAChM,0GAA0G;YAC1G,IAAI,iBAAiB,EAAE,EAAE,CAAC;gBACxB,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC3C,CAAC;YACD,+FAA+F;YAC/F,4FAA4F;YAC5F,0EAA0E;YAC1E,MAAM,yBAAyB,CAAC,GAAsB,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;YAC3F,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,uBAAuB,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;YACnG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5H,CAAC;QACH,CAAC;aAAM,CAAC;YACN,6IAA6I;YAC7I,wJAAwJ;YACxJ,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC,CAAC;YACvF,IAAI,SAAS,CAAC,MAAM;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC,KAAK,CAAC;YACvC,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;YAClG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACzC,kFAAkF;gBAClF,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,CAAC,IAAI,MAAM,YAAY,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,eAAe,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/I,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;QACrE,MAAM,cAAc,GAAG,WAAW;YAChC,CAAC,CAAC,oBAAoB,WAAW,CAAC,IAAI,KAAK,WAAW,CAAC,KAAK,cAAc,GAAG,IAAI,WAAW,CAAC,IAAI,iEAAiE;YAClK,CAAC,CAAC,EAAE,CAAC;QAEP,2IAA2I;QAC3I,uLAAuL;QACvL,IAAI,MAA0E,CAAC;QAC/E,IAAI,MAA0E,CAAC;QAC/E,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpD,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpD,MAAM,SAAS,GAAiC,EAAE,CAAC;YACnD,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrE,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC9C,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;YAC5B,CAAC;YACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACzE,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,cAAc,GAAG,IAAI,EAAE,CAAC,CAAC;gBACpG,IAAI,UAAU,CAAC,MAAM;oBAAE,MAAM,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC;gBAClH,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,cAAc,GAAG,IAAI,EAAE,CAAC,CAAC;gBAC3F,IAAI,UAAU,CAAC,MAAM;oBAAE,MAAM,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC;YACpH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,oEAAoE,KAAK,CAAC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtJ,CAAC;QACD,MAAM,SAAS,GAAG,MAAM;YACtB,CAAC,CAAC,oBAAoB,MAAM,CAAC,KAAK,YAAY,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,+CAA+C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAClK,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,SAAS,GAAG,MAAM;YACtB,CAAC,CAAC,kBAAkB,MAAM,CAAC,KAAK,yBAAyB,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,+FAA+F,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC7N,CAAC,CAAC,EAAE,CAAC;QAEP,OAAO;YACL,EAAE,EAAE,IAAI;YACR,GAAG;YACH,WAAW;YACX,MAAM;YACN,MAAM;YACN,OAAO,EACL,UAAU,KAAK,CAAC,IAAI,SAAS,GAAG,+BAA+B,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,KAAK;gBACxF,8IAA8I,cAAc,GAAG,SAAS,GAAG,SAAS,EAAE;SACzL,CAAC;IACJ,CAAC;IACH,iGAAiG;IACjG,oGAAoG;CACnG,CAAC,EAAE,eAAe,CAAC,CAAC"}

package/dist/agent/tools/clear_connector_override.d.ts

@@ -0,0 +1,48 @@
+import { type SurfaceBinding } from "../identity/binding.js";
+export interface ClearConnectorOverrideInput {
+    readonly connector: string;
+    readonly scopeKey?: string;
+}
+export interface ConnectorClearPlan {
+    readonly kind: "connector.clear";
+    readonly args: {
+        readonly org: string;
+        readonly scopeKey: string;
+        readonly connector: string;
+    };
+    readonly scopeKey: string;
+    readonly domain: string | null;
+}
+/** Pure input -> frozen-args mapping — same card-path / ACTING-sender refusals and
+ *  surface-scoped scopeKey defaulting as planRevokeConnector. No `reason` field: this
+ *  reverts to config, it doesn't introduce a new deviation that needs justifying. */
+export declare function planClearConnectorOverride(binding: SurfaceBinding, input: ClearConnectorOverrideInput, domain: string | null): ConnectorClearPlan;
+declare const _default: import("eve/tools").DynamicSentinel<import("eve/tools").ToolDefinition<{
+    connector: string;
+    scopeKey?: string | undefined;
+}, {
+    requested: boolean;
+    pendingId: string;
+    expiresAt?: string | undefined;
+    note: string;
+    autoApproved?: boolean | undefined;
+}> & {
+    execute(input: {
+        connector: string;
+        scopeKey?: string | undefined;
+    }, ctx: import("eve/tools").ToolContext): Promise<{
+        requested: boolean;
+        autoApproved: boolean;
+        pendingId: string;
+        note: string;
+        expiresAt?: undefined;
+    } | {
+        autoApproved?: undefined;
+        requested: boolean;
+        pendingId: string;
+        expiresAt: string;
+        note: string;
+    }>;
+}>;
+export default _default;
+//# sourceMappingURL=clear_connector_override.d.ts.map

package/dist/agent/tools/clear_connector_override.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clear_connector_override.d.ts","sourceRoot":"","sources":["../../../agent/tools/clear_connector_override.ts"],"names":[],"mappings":"AASA,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAU1F,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;qFAEqF;AACrF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,kBAAkB,CA2BjJ"}