@otto-assistant/bridge 0.4.102 → 0.4.103

package/src/discord-bot.ts

@@ -19,7 +19,7 @@ import {
 import {
   stopOpencodeServer,
 } from './opencode.js'
-import { formatWorktreeName, createWorktreeInBackground, worktreeCreatingMessage } from './commands/new-worktree.js'
+import { formatAutoWorktreeName, createWorktreeInBackground, worktreeCreatingMessage } from './commands/new-worktree.js'
 import { validateWorktreeDirectory, git } from './worktrees.js'
 import { WORKTREE_PREFIX } from './commands/merge-worktree.js'
 import {
@@ -43,7 +43,9 @@ import {
   getTextAttachments,
   resolveMentions,
 } from './message-formatting.js'
+import { extractBtwPrefix } from './btw-prefix-detection.js'
 import { isVoiceAttachment } from './voice-attachment.js'
+import { forkSessionToBtwThread } from './commands/btw.js'
 import {
   preprocessExistingThreadMessage,
   preprocessNewThreadMessage,
@@ -620,6 +622,40 @@ export async function startDiscordBot({
           }
         }
 
+        // Raw `btw ` mirrors /btw for fast side-question forks from Discord.
+        // Keep this at ingress instead of preprocess because it must create a
+        // new thread/runtime, not just transform the current prompt.
+        // Voice-transcribed `btw` still goes through normal preprocessing.
+        const btwShortcut =
+          projectDirectory && worktreeInfo?.status !== 'pending'
+            ? extractBtwPrefix(message.content || '')
+            : null
+        if (btwShortcut && projectDirectory) {
+          const result = await forkSessionToBtwThread({
+            sourceThread: thread,
+            projectDirectory,
+            prompt: btwShortcut.prompt,
+            userId: message.author.id,
+            username:
+              message.member?.displayName || message.author.displayName,
+            appId: currentAppId,
+          })
+
+          if (result instanceof Error) {
+            await message.reply({
+              content: result.message,
+              flags: SILENT_MESSAGE_FLAGS,
+            })
+            return
+          }
+
+          await message.reply({
+            content: `Session forked! Continue in ${result.thread.toString()}`,
+            flags: SILENT_MESSAGE_FLAGS,
+          })
+          return
+        }
+
         const hasVoiceAttachment = message.attachments.some((attachment) => {
           return isVoiceAttachment(attachment)
         })
@@ -817,7 +853,9 @@ export async function startDiscordBot({
         // and the first message's preprocess callback awaits it before resolving.
         let worktreePromise: Promise<string | Error> | undefined
         if (shouldUseWorktrees) {
-          const worktreeName = formatWorktreeName(
+          // Auto-derived from thread name -- compress long slugs so the
+          // folder path stays short and the agent doesn't reuse old worktrees.
+          const worktreeName = formatAutoWorktreeName(
             hasVoice ? `voice-${Date.now()}` : threadName.slice(0, 50),
           )
           discordLogger.log(`[WORKTREE] Creating worktree: ${worktreeName}`)

package/src/discord-command-registration.ts

@@ -182,7 +182,7 @@ export async function registerCommands({
     new SlashCommandBuilder()
       .setName('new-worktree')
       .setDescription(
-        truncateCommandDescription('Create a git worktree branch from HEAD by default. Optionally pick a base branch.'),
+        truncateCommandDescription('Create a git worktree from the current HEAD by default. Optionally pick a base branch.'),
       )
       .addStringOption((option) => {
         option
@@ -198,7 +198,7 @@ export async function registerCommands({
         option
           .setName('base-branch')
           .setDescription(
-            truncateCommandDescription('Branch to create the worktree from (default: HEAD)'),
+            truncateCommandDescription('Branch to create the worktree from (default: current HEAD)'),
           )
           .setRequired(false)
           .setAutocomplete(true)
@@ -384,6 +384,16 @@ export async function registerCommands({
     new SlashCommandBuilder()
       .setName('clear-queue')
       .setDescription(truncateCommandDescription('Clear all queued messages in this thread'))
+      .addIntegerOption((option) => {
+        option
+          .setName('position')
+          .setDescription(
+            truncateCommandDescription('1-based queued message position to clear (default: all)'),
+          )
+          .setMinValue(1)
+
+        return option
+      })
       .setDMPermission(false)
       .toJSON(),
     new SlashCommandBuilder()

package/src/memory-overview-plugin.ts

@@ -33,7 +33,9 @@ function createSessionState(): SessionState {
 }
 
 function buildMemoryOverviewReminder({ condensed }: { condensed: string }): string {
-  return `<system-reminder>Project memory from MEMORY.md (condensed table of contents, line numbers shown):\n${condensed}\nOnly headings are shown above — section bodies are hidden. Use Grep to search MEMORY.md for specific topics, or Read with offset and limit to read a section's content. When writing to MEMORY.md, keep titles concise (under 10 words) and content brief (2-3 sentences max). Only track non-obvious learnings that prevent future mistakes and are not already documented in code comments or AGENTS.md. Do not duplicate information that is self-evident from the code.</system-reminder>`
+  // Trailing newline so this synthetic part does not fuse with the next text
+  // part when the model concatenates message parts.
+  return `<system-reminder>Project memory from MEMORY.md (condensed table of contents, line numbers shown):\n${condensed}\nOnly headings are shown above — section bodies are hidden. Use Grep to search MEMORY.md for specific topics, or Read with offset and limit to read a section's content. When writing to MEMORY.md, keep titles concise (under 10 words) and content brief (2-3 sentences max). Only track non-obvious learnings that prevent future mistakes and are not already documented in code comments or AGENTS.md. Do not duplicate information that is self-evident from the code.</system-reminder>\n`
 }
 
 async function freezeMemoryOverview({

package/src/opencode.ts

@@ -64,6 +64,7 @@ import {
   prependPathEntry,
   selectResolvedCommand,
 } from './opencode-command.js'
+import { computeSkillPermission } from './skill-filter.js'
 
 const opencodeLogger = createLogger(LogPrefix.OPENCODE)
 
@@ -549,6 +550,13 @@ async function startSingleServer(): Promise<ServerStartError | SingleServer> {
   // OPENCODE_CONFIG_CONTENT was loaded last and overrode user project configs,
   // causing issue #90 (project permissions not being respected).
   const isDev = import.meta.url.endsWith('.ts') || import.meta.url.endsWith('.tsx')
+  // Skill whitelist/blacklist from --enable-skill / --disable-skill CLI flags.
+  // Applied as opencode permission.skill rules so every agent inherits the
+  // filter via Permission.merge(defaults, agentRules, user).
+  const skillPermission = computeSkillPermission({
+    enabledSkills: store.getState().enabledSkills,
+    disabledSkills: store.getState().disabledSkills,
+  })
   const opencodeConfig = {
     $schema: 'https://opencode.ai/config.json',
     lsp: false,
@@ -564,6 +572,7 @@ async function startSingleServer(): Promise<ServerStartError | SingleServer> {
       bash: 'allow',
       external_directory: externalDirectoryPermissions,
       webfetch: 'allow',
+      ...(skillPermission && { skill: skillPermission }),
     },
     agent: {
       explore: {

package/src/queue-question-select-drain.e2e.test.ts

@@ -38,6 +38,37 @@ async function waitForPendingQuestion({
   throw new Error('Timed out waiting for pending question context')
 }
 
+async function expectNoBotMessageContaining({
+  discord,
+  threadId,
+  text,
+  timeout,
+}: {
+  discord: Parameters<typeof waitForBotMessageContaining>[0]['discord']
+  threadId: string
+  text: string
+  timeout: number
+}): Promise<void> {
+  const start = Date.now()
+  while (Date.now() - start < timeout) {
+    const messages = await discord.thread(threadId).getMessages()
+    const match = messages.find((message) => {
+      return (
+        message.author.id === discord.botUserId
+        && message.content.includes(text)
+      )
+    })
+    if (match) {
+      throw new Error(
+        `Unexpected bot message containing ${JSON.stringify(text)} while it should still be queued`,
+      )
+    }
+    await new Promise<void>((resolve) => {
+      setTimeout(resolve, 20)
+    })
+  }
+}
+
 describe('queue drain after question select answer', () => {
   const ctx = setupQueueAdvancedSuite({
     channelId: TEXT_CHANNEL_ID,
@@ -75,16 +106,10 @@ describe('queue drain after question select answer', () => {
 
       // Get the pending question context hash from the internal map.
       // By this point the question message is visible so the context must exist.
-      const pending = (() => {
-        const entry = [...pendingQuestionContexts.entries()].find(([, context]) => {
-          return context.thread.id === thread.id
-        })
-        return entry ? { contextHash: entry[0] } : null
-      })()
-      expect(pending).toBeTruthy()
-      if (!pending) {
-        throw new Error('Expected pending question context')
-      }
+      const pending = await waitForPendingQuestion({
+        threadId: thread.id,
+        timeoutMs: 8_000,
+      })
       const questionMsg = questionMessages.find((m) => {
         return m.content.includes('How to proceed?')
       })!
@@ -149,4 +174,143 @@ describe('queue drain after question select answer', () => {
     },
     20_000,
   )
+
+  test(
+    'only the first queued message is handed off after dropdown answer',
+    async () => {
+      const marker = 'QUESTION_SELECT_QUEUE_MARKER second-test'
+
+      await ctx.discord.channel(TEXT_CHANNEL_ID).user(TEST_USER_ID).sendMessage({
+        content: marker,
+      })
+
+      const thread = await ctx.discord.channel(TEXT_CHANNEL_ID).waitForThread({
+        timeout: 8_000,
+        predicate: (t) => {
+          return t.name === marker
+        },
+      })
+
+      const th = ctx.discord.thread(thread.id)
+
+      const questionMessages = await waitForBotMessageContaining({
+        discord: ctx.discord,
+        threadId: thread.id,
+        text: 'How to proceed?',
+        timeout: 12_000,
+      })
+
+      const pending = await waitForPendingQuestion({
+        threadId: thread.id,
+        timeoutMs: 8_000,
+      })
+
+      const questionMsg = questionMessages.find((message) => {
+        return message.content.includes('How to proceed?')
+      })
+      expect(questionMsg).toBeTruthy()
+      if (!questionMsg) {
+        throw new Error('Expected question message')
+      }
+
+      const firstQueuedPrompt = 'SLOW_ABORT_MARKER run long response'
+      const secondQueuedPrompt = 'Reply with exactly: post-question-second'
+
+      const { id: firstQueueInteractionId } = await th.user(TEST_USER_ID)
+        .runSlashCommand({
+          name: 'queue',
+          options: [{ name: 'message', type: 3, value: firstQueuedPrompt }],
+        })
+
+      await th.waitForInteractionAck({
+        interactionId: firstQueueInteractionId,
+        timeout: 8_000,
+      })
+
+      const { id: secondQueueInteractionId } = await th.user(TEST_USER_ID)
+        .runSlashCommand({
+          name: 'queue',
+          options: [{ name: 'message', type: 3, value: secondQueuedPrompt }],
+        })
+
+      await th.waitForInteractionAck({
+        interactionId: secondQueueInteractionId,
+        timeout: 8_000,
+      })
+
+      const interaction = await th.user(TEST_USER_ID).selectMenu({
+        messageId: questionMsg.id,
+        customId: `ask_question:${pending.contextHash}:0`,
+        values: ['0'],
+      })
+
+      await th.waitForInteractionAck({
+        interactionId: interaction.id,
+        timeout: 8_000,
+      })
+
+      await waitForBotMessageContaining({
+        discord: ctx.discord,
+        threadId: thread.id,
+        text: `» **question-select-tester:** ${firstQueuedPrompt}`,
+        timeout: 8_000,
+      })
+
+      await expectNoBotMessageContaining({
+        discord: ctx.discord,
+        threadId: thread.id,
+        text: `» **question-select-tester:** ${secondQueuedPrompt}`,
+        timeout: 200,
+      })
+
+      await waitForFooterMessage({
+        discord: ctx.discord,
+        threadId: thread.id,
+        timeout: 8_000,
+        afterMessageIncludes: `» **question-select-tester:** ${firstQueuedPrompt}`,
+        afterAuthorId: ctx.discord.botUserId,
+      })
+
+      await waitForBotMessageContaining({
+        discord: ctx.discord,
+        threadId: thread.id,
+        text: `» **question-select-tester:** ${secondQueuedPrompt}`,
+        timeout: 8_000,
+      })
+
+      await waitForFooterMessage({
+        discord: ctx.discord,
+        threadId: thread.id,
+        timeout: 8_000,
+        afterMessageIncludes: `» **question-select-tester:** ${secondQueuedPrompt}`,
+        afterAuthorId: ctx.discord.botUserId,
+      })
+
+      const timeline = await th.text({ showInteractions: true })
+      expect(timeline).toMatchInlineSnapshot(`
+        "--- from: user (question-select-tester)
+        QUESTION_SELECT_QUEUE_MARKER second-test
+        --- from: assistant (TestBot)
+        **Select action**
+        How to proceed?
+        ✓ _Alpha_
+        [user interaction]
+        Queued message (position 1)
+        [user interaction]
+        Queued message (position 2)
+        [user selects dropdown: 0]
+        » **question-select-tester:** SLOW_ABORT_MARKER run long response
+        ⬥ slow-response-started
+        *project ⋅ main ⋅ Ns ⋅ N% ⋅ deterministic-v2*
+        » **question-select-tester:** Reply with exactly: post-question-second
+        ⬥ ok
+        *project ⋅ main ⋅ Ns ⋅ N% ⋅ deterministic-v2*"
+      `)
+      expect(timeline).toContain(`» **question-select-tester:** ${firstQueuedPrompt}`)
+      expect(timeline).toContain('⬥ slow-response-started')
+      expect(timeline).toContain(`» **question-select-tester:** ${secondQueuedPrompt}`)
+      expect(timeline).toContain('⬥ ok')
+    },
+    20_000,
+  )
 })

package/src/session-handler/thread-runtime-state.ts

@@ -80,7 +80,8 @@ export type ThreadRunState = {
   // FIFO queue of pending inputs waiting for kimaki-local dispatch.
   // Normal user messages default to opencode queue mode; this queue is
   // for explicit local-queue flows (for example /queue).
-  // Changes: enqueueItem (append), dequeueItem (head removal), clearQueueItems.
+  // Changes: enqueueItem (append), dequeueItem (head removal),
+  // clearQueueItems, removeQueueItemAtPosition.
   // Read by: runtime queue gating, hasQueue helpers, /queue command display.
   queueItems: QueuedMessage[]
 
@@ -201,6 +202,40 @@ export function clearQueueItems(threadId: string): void {
   updateThread(threadId, (t) => ({ ...t, queueItems: [] }))
 }
 
+export function removeQueueItemAtPosition(
+  threadId: string,
+  position: number,
+): QueuedMessage | undefined {
+  if (position < 1) {
+    return undefined
+  }
+
+  let removedItem: QueuedMessage | undefined
+  store.setState((s) => {
+    const t = s.threads.get(threadId)
+    if (!t) {
+      return s
+    }
+
+    const index = position - 1
+    const removed = t.queueItems[index]
+    if (!removed) {
+      return s
+    }
+
+    removedItem = removed
+    const newThreads = new Map(s.threads)
+    newThreads.set(threadId, {
+      ...t,
+      queueItems: t.queueItems.filter((_, itemIndex) => {
+        return itemIndex !== index
+      }),
+    })
+    return { threads: newThreads }
+  })
+  return removedItem
+}
+
 // ── Queries ──────────────────────────────────────────────────────
 
 export function getThreadState(threadId: string): ThreadRunState | undefined {

package/src/session-handler/thread-session-runtime.ts

@@ -404,11 +404,14 @@ export function isEssentialToolPart(part: Part): boolean {
 const DISCORD_THREAD_NAME_MAX = 100
 const WORKTREE_THREAD_PREFIX = '⬦ '
 
-// Pure derivation: given an OpenCode session title and the current thread name,
-// return the new thread name to apply, or undefined when no rename is needed.
-// - Skips placeholder titles ("New Session - ...") to match external-sync.
-// - Preserves worktree prefix when the current name carries it.
-// - Returns undefined when the candidate matches currentName already.
+// Prefixes that should survive OpenCode session title renames.
+// When a thread starts with one of these, the rename preserves it.
+const PRESERVED_THREAD_PREFIXES: string[] = [
+  WORKTREE_THREAD_PREFIX,
+  'btw: ',
+  'Fork: ',
+]
+
 export function deriveThreadNameFromSessionTitle({
   sessionTitle,
   currentName,
@@ -423,9 +426,11 @@ export function deriveThreadNameFromSessionTitle({
   if (/^new session\s*-/i.test(trimmed)) {
     return undefined
   }
-  const hasWorktreePrefix = currentName.startsWith(WORKTREE_THREAD_PREFIX)
-  const prefix = hasWorktreePrefix ? WORKTREE_THREAD_PREFIX : ''
-  const candidate = `${prefix}${trimmed}`.slice(0, DISCORD_THREAD_NAME_MAX)
+  const matchedPrefix =
+    PRESERVED_THREAD_PREFIXES.find((p) => {
+      return currentName.startsWith(p)
+    }) ?? ''
+  const candidate = `${matchedPrefix}${trimmed}`.slice(0, DISCORD_THREAD_NAME_MAX)
   if (candidate === currentName) {
     return undefined
   }
@@ -2069,6 +2074,8 @@ export class ThreadSessionRuntime {
   }
 
   private async handleMainPart(part: Part): Promise<void> {
+    const sessionId = this.state?.sessionId
+
     if (part.type === 'step-start') {
       this.ensureTypingNow()
       return
@@ -2084,13 +2091,42 @@ export class ThreadSessionRuntime {
 
       // Track task tool spawning subtask sessions
       if (part.tool === 'task' && !this.state?.sentPartIds.has(part.id)) {
-        const description = (part.state.input?.description as string) || ''
-        const agent = (part.state.input?.subagent_type as string) || 'task'
-        const childSessionId = (part.state.metadata?.sessionId as string) || ''
+        const description =
+          typeof part.state.input?.description === 'string'
+            ? part.state.input.description
+            : ''
+        const agent =
+          typeof part.state.input?.subagent_type === 'string'
+            ? part.state.input.subagent_type
+            : 'task'
+        const childSessionId =
+          typeof part.state.metadata?.sessionId === 'string'
+            ? part.state.metadata.sessionId
+            : ''
         if (description && childSessionId) {
           if ((await this.getVerbosity()) !== 'text_only') {
             const taskDisplay = `┣ ${agent} **${description}**`
-            await sendThreadMessage(this.thread, taskDisplay + '\n\n')
+            threadState.updateThread(this.threadId, (t) => {
+              const newIds = new Set(t.sentPartIds)
+              newIds.add(part.id)
+              return { ...t, sentPartIds: newIds }
+            })
+            const sendResult = await errore.tryAsync(() => {
+              return sendThreadMessage(this.thread, taskDisplay + '\n\n')
+            })
+            if (sendResult instanceof Error) {
+              threadState.updateThread(this.threadId, (t) => {
+                const newIds = new Set(t.sentPartIds)
+                newIds.delete(part.id)
+                return { ...t, sentPartIds: newIds }
+              })
+              discordLogger.error(
+                `ERROR: Failed to send task part ${part.id}:`,
+                sendResult,
+              )
+              return
+            }
+            await setPartMessage(part.id, sendResult.id, this.thread.id)
           }
         }
       }
@@ -2594,8 +2630,9 @@ export class ThreadSessionRuntime {
 
     // When a question is answered and the local queue has items, the model may
     // continue the same run without ever reaching the local-queue idle gate.
-    // Hand the queued items to OpenCode's own prompt queue immediately instead
-    // of waiting for tryDrainQueue() to see an idle session.
+    // Hand off only the next queued item to OpenCode immediately so the queue
+    // resumes, but keep later items local so their `» user:` indicators still
+    // appear one-by-one when they actually become active.
     if (this.getQueueLength() > 0 && !this.questionReplyQueueHandoffPromise) {
       logger.log(
         `[QUESTION REPLIED] Queue has ${this.getQueueLength()} items, handing off to opencode queue`,
@@ -2614,8 +2651,8 @@ export class ThreadSessionRuntime {
   }
 
   // Detached helper promise for the "question answered while local queue has
-  // items" flow. Prevents starting two overlapping local->opencode queue
-  // handoff sequences when multiple question replies land close together.
+  // items" flow. Prevents starting two overlapping single-item handoffs when
+  // multiple question replies land close together.
   private questionReplyQueueHandoffPromise: Promise<void> | null = null
 
   private async handoffQueuedItemsAfterQuestionReply({
@@ -2633,24 +2670,22 @@ export class ThreadSessionRuntime {
       return
     }
 
-    while (this.state?.sessionId === sessionId) {
-      const next = threadState.dequeueItem(this.threadId)
-      if (!next) {
-        return
-      }
-
-      const displayText = next.command
-        ? `/${next.command.name}`
-        : `${next.prompt.slice(0, 150)}${next.prompt.length > 150 ? '...' : ''}`
-      if (displayText.trim()) {
-        await sendThreadMessage(
-          this.thread,
-          `» **${next.username}:** ${displayText}`,
-        )
-      }
+    const next = threadState.dequeueItem(this.threadId)
+    if (!next) {
+      return
+    }
 
-      await this.submitViaOpencodeQueue(next)
+    const displayText = next.command
+      ? `/${next.command.name}`
+      : `${next.prompt.slice(0, 150)}${next.prompt.length > 150 ? '...' : ''}`
+    if (displayText.trim()) {
+      await sendThreadMessage(
+        this.thread,
+        `» **${next.username}:** ${displayText}`,
+      )
     }
+
+    await this.submitViaOpencodeQueue(next)
   }
 
   private async handleSessionStatus(properties: {
@@ -3398,6 +3433,11 @@ export class ThreadSessionRuntime {
     threadState.clearQueueItems(this.threadId)
   }
 
+  /** Remove a queued message by its 1-based position. */
+  removeQueuePosition(position: number): threadState.QueuedMessage | undefined {
+    return threadState.removeQueueItemAtPosition(this.threadId, position)
+  }
+
   // ── Queue Drain ─────────────────────────────────────────────
 
   /**

package/src/session-title-rename.test.ts

@@ -95,6 +95,24 @@ describe('deriveThreadNameFromSessionTitle', () => {
     ).toMatchInlineSnapshot(`undefined`)
   })
 
+  test('preserves btw: prefix from current name', () => {
+    expect(
+      deriveThreadNameFromSessionTitle({
+        sessionTitle: 'Side question about auth',
+        currentName: 'btw: why is auth broken',
+      }),
+    ).toMatchInlineSnapshot(`"btw: Side question about auth"`)
+  })
+
+  test('preserves Fork: prefix from current name', () => {
+    expect(
+      deriveThreadNameFromSessionTitle({
+        sessionTitle: 'Forked task title',
+        currentName: 'Fork: old session title',
+      }),
+    ).toMatchInlineSnapshot(`"Fork: Forked task title"`)
+  })
+
   test('returns undefined for null/undefined title', () => {
     expect(
       deriveThreadNameFromSessionTitle({

package/src/skill-filter.test.ts

@@ -0,0 +1,83 @@
+import { describe, test, expect } from 'vitest'
+import { computeSkillPermission } from './skill-filter.js'
+
+describe('computeSkillPermission', () => {
+  test('empty inputs returns undefined (no filtering)', () => {
+    expect(
+      computeSkillPermission({ enabledSkills: [], disabledSkills: [] }),
+    ).toMatchInlineSnapshot(`undefined`)
+  })
+
+  test('whitelist single skill', () => {
+    expect(
+      computeSkillPermission({
+        enabledSkills: ['npm-package'],
+        disabledSkills: [],
+      }),
+    ).toMatchInlineSnapshot(`
+      {
+        "*": "deny",
+        "npm-package": "allow",
+      }
+    `)
+  })
+
+  test('whitelist multiple skills', () => {
+    expect(
+      computeSkillPermission({
+        enabledSkills: ['npm-package', 'playwriter', 'errore'],
+        disabledSkills: [],
+      }),
+    ).toMatchInlineSnapshot(`
+      {
+        "*": "deny",
+        "errore": "allow",
+        "npm-package": "allow",
+        "playwriter": "allow",
+      }
+    `)
+  })
+
+  test('blacklist single skill', () => {
+    expect(
+      computeSkillPermission({
+        enabledSkills: [],
+        disabledSkills: ['jitter'],
+      }),
+    ).toMatchInlineSnapshot(`
+      {
+        "jitter": "deny",
+      }
+    `)
+  })
+
+  test('blacklist multiple skills', () => {
+    expect(
+      computeSkillPermission({
+        enabledSkills: [],
+        disabledSkills: ['jitter', 'termcast'],
+      }),
+    ).toMatchInlineSnapshot(`
+      {
+        "jitter": "deny",
+        "termcast": "deny",
+      }
+    `)
+  })
+
+  test('whitelist takes precedence when both are set (cli.ts is expected to reject this upstream)', () => {
+    // cli.ts validates mutual exclusion before reaching this helper. This
+    // test documents the defensive behavior if both arrays ever leak through.
+    expect(
+      computeSkillPermission({
+        enabledSkills: ['npm-package'],
+        disabledSkills: ['jitter'],
+      }),
+    ).toMatchInlineSnapshot(`
+      {
+        "*": "deny",
+        "npm-package": "allow",
+      }
+    `)
+  })
+})