@playcraft/cli 0.1.70 → 0.1.72

package/dist/workspace-runtime/codex/skill-discovery-broker.js

@@ -0,0 +1,174 @@
+import { realpath } from 'node:fs/promises';
+import { isAbsolute, relative } from 'node:path';
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+import { remoteSkillMatchRequestSchema, remoteSkillMatchResultSchema, remoteSkillSelectionRequestSchema, remoteSkillArtifactRequestSchema, remoteSkillActivationRequestSchema, parseRemoteSkillSelectionResult, } from '@playcraft/common/project-skills';
+import { platformEndpoint, skillActivationRegistrationSchema } from '@playcraft/common/cloud-workspace/runtime';
+import { workspaceContextFromRoot } from '../workspaces/registry.js';
+import { loadWorkspaceSkillArtifact } from '../workspaces/skill-artifact-loader.js';
+import { verifyLauncherOrigin } from './launcher-client.js';
+import { registerSkillActivationRequest } from '../workspaces/skill-activation-requests.js';
+const requestSchema = z.object({ cwd: z.string().min(1).max(4096), input: z.unknown() }).strict();
+const MAX_METADATA_BYTES = 4 * 1024 * 1024;
+const SELECTION_TTL_MS = 15 * 60_000;
+/** Resolves candidates with control identity; shell capability never authorizes changing the active lock. */
+export class WorkspaceSkillDiscoveryBroker {
+    state;
+    selections = new Map();
+    constructor(state) {
+        this.state = state;
+    }
+    operation(context, valid) {
+        const state = this.state, session = state.journal.getSession(context.sessionId);
+        const operations = state.journal.listOperations().map(item => item.operation).filter(operation => operation.kind === 'session.turn' && operation.sessionId === context.sessionId && operation.clientRequestId === context.clientRequestId
+            && operation.generation === state.config.generation && operation.runtimeEpoch === state.runtimeEpoch
+            && ['dispatched', 'accepted'].includes(operation.status));
+        const operation = operations.length === 1 ? operations[0] : undefined;
+        if (!valid() || context.refsBlocked || state.journal.destroyed() || !operation?.workspaceId || !operation.directoryName
+            || operation.directoryName === 'root' || !operation.nativeThreadId || !operation.nativeTurnId
+            || !session || session.threadId !== operation.nativeThreadId || session.activeTurnId !== operation.nativeTurnId
+            || session.cwd !== context.cwd || session.workspaceId !== operation.workspaceId
+            || (session.directoryName ?? 'basic') !== operation.directoryName || session.turnBlock
+            || !['running', 'waiting_for_user'].includes(session.turnStatus ?? ''))
+            throw new Error('skill_discovery_turn_unavailable');
+        return operation;
+    }
+    async current(context, valid) {
+        const operation = this.operation(context, valid);
+        const scope = await workspaceContextFromRoot(this.state, context.cwd);
+        if (scope.workspaceId !== operation.workspaceId || scope.directoryName !== operation.directoryName)
+            throw new Error('skill_discovery_scope_mismatch');
+        this.operation(context, valid);
+        return scope;
+    }
+    selectionKey(context, selectionId) {
+        return JSON.stringify([this.state.config.runtimeId, this.state.config.generation, this.state.runtimeEpoch,
+            context.cwd, context.sessionId, context.clientRequestId, selectionId]);
+    }
+    async forward(request, response, context, valid, action) {
+        const reply = (status, value) => {
+            response.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+            response.end(JSON.stringify(value));
+        };
+        try {
+            if (request.socket.remoteAddress !== '127.0.0.1')
+                throw new Error('skill_discovery_turn_unavailable');
+            let text = '';
+            for await (const chunk of request) {
+                text += chunk.toString();
+                if (Buffer.byteLength(text) > 32 * 1024)
+                    throw new Error('skill_discovery_invalid_request');
+            }
+            const parsed = requestSchema.safeParse(JSON.parse(text));
+            if (!parsed.success)
+                throw new Error('skill_discovery_invalid_request');
+            const scope = await this.current(context, valid);
+            const callerCwd = await realpath(parsed.data.cwd);
+            const childPath = relative(context.cwd, callerCwd);
+            if (isAbsolute(childPath) || childPath === '..' || childPath.startsWith('../'))
+                throw new Error('skill_discovery_scope_mismatch');
+            const socketPath = process.env.PLAYCRAFT_LAUNCHER_SOCKET;
+            if (!socketPath || !context.boundaryId || !request.socket.localPort || !request.socket.remotePort
+                || !await verifyLauncherOrigin({ socketPath, boundaryId: context.boundaryId, runtimeEpoch: this.state.runtimeEpoch,
+                    serverPort: request.socket.localPort, clientPort: request.socket.remotePort, cwd: context.originCwd ?? callerCwd }))
+                throw new Error('skill_discovery_turn_unavailable');
+            await this.current(context, valid);
+            if (action === 'activate') {
+                const input = remoteSkillActivationRequestSchema.safeParse(parsed.data.input);
+                if (!input.success)
+                    throw new Error('skill_discovery_invalid_request');
+                const operation = this.operation(context, valid);
+                if (context.readOnly || operation.workMode === 'plan' || operation.permissionMode === 'read-only'
+                    || this.state.journal.getSession(context.sessionId)?.permissionMode === 'read-only')
+                    throw new Error('skill_discovery_readonly');
+                const selected = this.selections.get(this.selectionKey(context, input.data.selectionId));
+                if (!selected || selected.expiresAt <= Date.now())
+                    throw new Error('skill_discovery_selection_unavailable');
+                const result = await registerSkillActivationRequest(this.state, {
+                    cwd: context.cwd, sessionId: context.sessionId, clientRequestId: context.clientRequestId, requestedSkillRefs: selected.requestedSkillRefs,
+                }, selected.selection);
+                await this.current(context, valid);
+                return reply(200, skillActivationRegistrationSchema.parse(result));
+            }
+            if (action === 'artifact') {
+                const input = remoteSkillArtifactRequestSchema.safeParse(parsed.data.input);
+                if (!input.success)
+                    throw new Error('skill_discovery_invalid_request');
+                const selection = this.selections.get(this.selectionKey(context, input.data.selectionId));
+                const entry = selection && selection.expiresAt > Date.now() ? selection.entries.find(item => item.entryKey === input.data.entryKey) : undefined;
+                if (!entry)
+                    throw new Error('skill_discovery_selection_unavailable');
+                const archive = await loadWorkspaceSkillArtifact(this.state, scope.workspaceId, entry, scope.directoryName);
+                await this.current(context, valid);
+                selection.expiresAt = Date.now() + SELECTION_TTL_MS;
+                return reply(200, { content: archive.toString('base64'), artifactHash: createHash('sha256').update(archive).digest('hex') });
+            }
+            const query = action === 'match' ? remoteSkillMatchRequestSchema.safeParse(parsed.data.input)
+                : remoteSkillSelectionRequestSchema.safeParse(parsed.data.input);
+            if (!query.success)
+                throw new Error('skill_discovery_invalid_request');
+            const raw = await this.upstream(scope, action, query.data);
+            await this.current(context, valid);
+            if (action === 'match')
+                return reply(200, remoteSkillMatchResultSchema.parse(raw));
+            const value = parseRemoteSkillSelectionResult(raw);
+            const selection = remoteSkillSelectionRequestSchema.parse(query.data);
+            for (const requested of selection.skills) {
+                if (!value.lock.entries.some(entry => entry.revision.kind === 'release' && entry.revision.skillRef === requested.skillRef
+                    && entry.revision.version === requested.version && entry.revision.artifactHash === requested.artifactHash)
+                    || !value.skills.some(item => item.skillVersionId === requested.skillVersionId && item.skillRef === requested.skillRef
+                        && item.version === requested.version && item.artifactHash === requested.artifactHash))
+                    throw new Error('skill_discovery_invalid_response');
+            }
+            for (const [key, cached] of this.selections)
+                if (cached.expiresAt <= Date.now())
+                    this.selections.delete(key);
+            if (this.selections.size >= 64)
+                this.selections.delete(this.selections.keys().next().value);
+            this.selections.set(this.selectionKey(context, value.selectionId), { expiresAt: Date.now() + SELECTION_TTL_MS, entries: value.lock.entries,
+                selection: value, requestedSkillRefs: selection.skills.map(skill => skill.skillRef) });
+            return reply(200, value);
+        }
+        catch (error) {
+            if (response.headersSent) {
+                response.destroy();
+                return;
+            }
+            const code = error instanceof SyntaxError ? 'skill_discovery_invalid_request'
+                : error instanceof Error && /^(?:skill_discovery_|workspace_skills_)[a-z_]+$/.test(error.message)
+                    ? error.message : 'skill_discovery_unavailable';
+            reply(code === 'skill_discovery_invalid_request' ? 400 : code === 'skill_discovery_unavailable' ? 503 : 403, { error: { code } });
+        }
+    }
+    async upstream(scope, action, input) {
+        const config = this.state.config;
+        const response = await fetch(platformEndpoint(config.publicBaseUrl, `/runtime/internal/skill-discovery/${action}`), {
+            method: 'POST', redirect: 'error', signal: AbortSignal.timeout(45_000),
+            headers: { authorization: `Bearer ${config.controlToken}`, 'content-type': 'application/json', 'playcraft-env': config.environment },
+            body: JSON.stringify({ runtimeId: config.runtimeId, generation: config.generation, runtimeEpoch: this.state.runtimeEpoch,
+                workspaceId: scope.workspaceId, directoryName: scope.directoryName, input }),
+        });
+        if (!response.ok || !response.body) {
+            await response.body?.cancel().catch(() => undefined);
+            throw new Error('skill_discovery_unavailable');
+        }
+        const chunks = [];
+        let bytes = 0;
+        const reader = response.body.getReader();
+        try {
+            while (true) {
+                const chunk = await reader.read();
+                if (chunk.done)
+                    break;
+                bytes += chunk.value.byteLength;
+                if (bytes > MAX_METADATA_BYTES)
+                    throw new Error('skill_discovery_invalid_response');
+                chunks.push(Buffer.from(chunk.value));
+            }
+        }
+        finally {
+            await reader.cancel().catch(() => undefined);
+        }
+        return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    }
+}

package/dist/workspace-runtime/serve.js

@@ -37,6 +37,8 @@ import { platformExportTarget, readPlatformExport, startPlatformExport } from '.
 import { scheduledTaskProposalHandler } from './workspaces/scheduled-task-proposals.js';
 import { executionContextToolHandler } from './workspaces/execution-context.js';
 import { registerLevelEditorRequest, startLevelEditorRequestQueue, stopLevelEditorRequestQueue } from './workspaces/level-editor-requests.js';
+import { startSkillActivationRequestQueue, stopSkillActivationRequestQueue } from './workspaces/skill-activation-requests.js';
+import { recoverInterruptedSkillActivations } from './workspaces/skill-activation-recovery.js';
 import { proceduralSkillHandler } from './workspaces/procedural-3d/host.js';
 import { recoverModelPreviewOperations } from './workspaces/procedural-3d/model-preview-recovery.js';
 import { recoverModelPreparationOperations, stopModelPreparations } from './workspaces/model-preparation.js';
@@ -83,6 +85,7 @@ export async function startWorkspaceRuntime(config, options = {}) {
             executionQueue: Promise.resolve(),
             instanceToken: randomUUID(),
         };
+        await recoverInterruptedSkillActivations(state);
         const recoveredImports = new Map();
         await recoverModelPreviewOperations(state, { identityMatches: previousIdentityMatches,
             runtimeEpoch: config.runtimeEpoch, previousRuntimeEpoch: previousEpoch,
@@ -348,12 +351,14 @@ export async function startWorkspaceRuntime(config, options = {}) {
         });
         const port = await listenOn(server, config.listen.host, config.listen.port);
         startLevelEditorRequestQueue(state);
+        startSkillActivationRequestQueue(state);
         return {
             config: state.config,
             state,
             url: `http://${formatHost(config.listen.host)}:${port}`,
             async close() {
                 stopLevelEditorRequestQueue(state);
+                await stopSkillActivationRequestQueue(state);
                 const serverClosed = closeServer(server);
                 await stopParameterVerifications(state);
                 await stopModelPreparations(state);

package/dist/workspace-runtime/server/directory-access.js

@@ -1,6 +1,7 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { randomUUID } from 'node:crypto';
 import { isTurnControl, takesWorkspaceDirectory, takesExecutionSlot, transitionOperation, } from '@playcraft/common/cloud-workspace/runtime';
+import { batchDirectoryHeld } from '../batch/occupancy.js';
 import { listMembers, readSnapshot } from '../batch/records.js';
 const context = new AsyncLocalStorage();
 const gates = new WeakMap();
@@ -481,6 +482,15 @@ export function releaseBatchDirectory(state, member) {
     if (!member.holding && member.writersStopped)
         instances.get(state)?.release(`run:${member.runId}`);
 }
+/**
+ * A lease rejection names its cause so callers can tell a running batch member apart from ordinary
+ * directory contention: the former is a production lock, not a failure. A damaged member record
+ * must not replace the rejection with a failed response.
+ */
+export async function directoryBusyCode(state, workspaceId, directoryName = 'basic') {
+    const held = await batchDirectoryHeld(state, workspaceId, directoryName).catch(() => false);
+    return held ? 'batch_workspace_readonly' : 'directory_busy';
+}
 export async function withDirectoryFreeze(state, scope, action, quiesce, options) {
     const pending = freezing.get(state) ??
         new Map();

package/dist/workspace-runtime/server/dispatch.js

@@ -9,7 +9,7 @@ import { remoteAttachPending } from '../workspaces/remote-attach-marker.js';
 import { cancelPendingDirectoryAccess, holdDirectoryAccess, withOperationDirectoryAccess, } from './directory-access.js';
 import { join } from 'node:path';
 import { z } from 'zod';
-import { fileWritePayloadSchema, fileBinaryWritePayloadSchema, directoryCreatePayloadSchema, directoryRenamePayloadSchema, directoryDeletePayloadSchema, directoryMutationReceiptSchema, gitCommitPayloadSchema, gitPathsPayloadSchema, gitPushPayloadSchema, gitPullPayloadSchema, gitMergeAbortPayloadSchema, hashOperationPayload, parameterPatchPayloadSchema, parameterAgentTaskRequestSchema, parameterAgentVerifyPayloadSchema, levelEditorTaskRequestSchema, levelEditorVerifyPayloadSchema, levelEditorTransactionRequestSchema, productionSessionAttemptId, reasoningEffortSchema, workspacePermissionModeSchema, workspaceComposerSelectionSchema, workspaceReviewPayloadSchema, workspaceCompactPayloadSchema, workspaceSteerPayloadSchema, workspaceApprovalResponseSchema, terminalCreatePayloadSchema, terminalProcessIdentity, transitionOperation, recoverUncertainOperation, workspaceSavePayloadSchema, workspaceSkillsUpdatePayloadSchema, workspaceRemixReferenceImportPayloadSchema, workspaceModelPreviewBuildSchema, workspaceModelPreviewCancelSchema, isSoundDocumentPath, } from '@playcraft/common/cloud-workspace/runtime';
+import { fileWritePayloadSchema, fileBinaryWritePayloadSchema, directoryCreatePayloadSchema, directoryRenamePayloadSchema, directoryDeletePayloadSchema, directoryMutationReceiptSchema, gitCommitPayloadSchema, gitPathsPayloadSchema, gitPushPayloadSchema, gitPullPayloadSchema, gitMergeAbortPayloadSchema, hashOperationPayload, parameterPatchPayloadSchema, parameterAgentTaskRequestSchema, parameterAgentVerifyPayloadSchema, levelEditorTaskRequestSchema, skillActivationPayloadSchema, levelEditorVerifyPayloadSchema, levelEditorTransactionRequestSchema, productionSessionAttemptId, reasoningEffortSchema, workspacePermissionModeSchema, workspaceComposerSelectionSchema, workspaceReviewPayloadSchema, workspaceCompactPayloadSchema, workspaceSteerPayloadSchema, workspaceApprovalResponseSchema, terminalCreatePayloadSchema, terminalProcessIdentity, transitionOperation, recoverUncertainOperation, workspaceSavePayloadSchema, workspaceSkillsUpdatePayloadSchema, workspaceRemixReferenceImportPayloadSchema, workspaceModelPreviewBuildSchema, workspaceModelPreviewCancelSchema, isSoundDocumentPath, } from '@playcraft/common/cloud-workspace/runtime';
 import { closeCliCredentials, ensureCliCredentials } from '../workspaces/cli-credentials.js';
 import { artifactFormat } from '../workspaces/artifact-files.js';
 import { refreshWorkspaceArtifacts } from '../workspaces/artifact-events.js';
@@ -52,6 +52,7 @@ import { prepareLevelEditorTask, finishLevelEditorTask, verifyLevelEditorTask, }
 import { readWorkspaceLevelEditor, transactWorkspaceLevelEditor, reconcileWorkspaceLevelEditorTransaction, } from '../workspaces/level-editor.js';
 import { readLevelEditorHistory } from '../workspaces/level-editor-history-store.js';
 import { wakeLevelEditorRequests, ensureLevelEditorTaskPipeline, retryLevelEditorRequest, assertLevelEditorRetryInput, } from '../workspaces/level-editor-requests.js';
+import { activateSkillSelectionForTurn, cancelSkillActivationPreparation, skillActivationRuntimeClosing, waitForSkillActivationIdle } from '../workspaces/skill-activation-requests.js';
 const CONVERSATION_KINDS = new Set([
     'session.create',
     'session.turn',
@@ -94,6 +95,7 @@ const LOCAL_KINDS = new Set([
 ]);
 const parameterVerifications = new WeakMap();
 const parameterVerificationClosing = new WeakSet();
+const nativePreparations = new WeakMap();
 export async function stopParameterVerifications(state) {
     parameterVerificationClosing.add(state);
     const tasks = parameterVerifications.get(state);
@@ -146,9 +148,30 @@ export async function executeOperation(state, scopeKey, operation, payload, reco
     if (['runtime.destroy', 'session.interrupt', 'session.approval.respond', 'session.steer', 'preview.publish', 'model.preview', 'model.preview.cancel', 'model.prepare'].includes(operation.kind)) {
         return run();
     }
-    return state.journal.exclusive(operation.kind.startsWith('session.') && operation.sessionId
+    const execute = () => state.journal.exclusive(operation.kind.startsWith('session.') && operation.sessionId
         ? `session-execution:${operation.sessionId}`
         : `workspace:${revisionScope(state, operation.workspaceId, operation.directoryName) ?? 'single'}`, run);
+    if (!['session.turn', 'session.review', 'session.compact'].includes(operation.kind))
+        return execute();
+    const pending = nativePreparations.get(state) ?? new Map();
+    nativePreparations.set(state, pending);
+    const entry = { scopeKey, operation, held: false, activation: operation.kind === 'session.turn'
+            && skillActivationPayloadSchema.safeParse(asRecord(payload).skillActivation).success };
+    pending.set(operation.operationId, entry);
+    try {
+        return await state.journal.exclusive('native-preparation', async () => {
+            entry.held = true;
+            const live = state.journal.getOperation(scopeKey) ?? operation;
+            if (['completed', 'failed', 'interrupted'].includes(live.status))
+                return live;
+            if (skillActivationRuntimeClosing(state))
+                return persist(state, scopeKey, transitionOperation(live, 'interrupted', { error: 'runtime_stopping' }));
+            return execute();
+        });
+    }
+    finally {
+        pending.delete(operation.operationId);
+    }
 }
 async function executeScopedOperation(state, scopeKey, operation, payload, recovery) {
     let current = await persist(state, scopeKey, transitionOperation(operation, 'dispatched'));
@@ -440,16 +463,39 @@ async function executeTurn(state, scopeKey, operation, payload, recovery) {
     const levelEditorTask = levelEditorTaskRequestSchema.optional().safeParse(body.levelEditorTask);
     if (!levelEditorTask.success || levelEditorTask.data && (parameterTask.data || levelEditorTask.data.taskId !== operation.clientRequestId))
         return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: 'invalid_level_editor_task' }));
-    if (parameterTask.data || levelEditorTask.data) {
+    const skillActivation = skillActivationPayloadSchema.optional().safeParse(body.skillActivation);
+    if (!skillActivation.success || skillActivation.data && (parameterTask.data || levelEditorTask.data
+        || skillActivation.data.requestId !== operation.clientRequestId || skillActivation.data.sourceSessionId !== sessionId))
+        return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: 'skill_activation_request_invalid' }));
+    if (parameterTask.data || levelEditorTask.data || skillActivation.data) {
         if (operation.directoryName === 'root')
             return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: 'invalid_workspace_directory' }));
         if ((selection.data.workMode ?? 'execute') !== 'execute' || requestedMode === 'read-only')
-            return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: levelEditorTask.data ? 'level_editor_task_requires_execute' : 'parameter_task_readonly' }));
+            return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: skillActivation.data ? 'skill_activation_requires_execute' : levelEditorTask.data ? 'level_editor_task_requires_execute' : 'parameter_task_readonly' }));
         if (workspaceSessions(state, operation.workspaceId, operation.directoryName).some(sessionTurnBusy))
             return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: 'turn_already_active' }));
         if (await batchDirectoryHeld(state, operation.workspaceId, operation.directoryName))
             return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: 'batch_workspace_readonly' }));
     }
+    let activatedSkillSelection;
+    if (skillActivation.data) {
+        try {
+            if (!found || operation.directoryAccessMode !== 'exclusive' || selection.data.context?.skills.length)
+                throw new Error('skill_activation_request_invalid');
+            // Repair an interrupted activation pair before session recovery can read or freeze that pair.
+            await waitForSkillActivationIdle(state, operation, skillActivation.data);
+            activatedSkillSelection = await activateSkillSelectionForTurn(state, operation, skillActivation.data, await sessionWorkspaceRoot(state, operation.workspaceId, operation.directoryName));
+        }
+        catch (error) {
+            const live = state.journal.getOperation(scopeKey);
+            if (live && ['failed', 'interrupted'].includes(live.status))
+                return live;
+            return persist(state, scopeKey, transitionOperation(operation, 'failed', {
+                error: error instanceof Error && /^(?:skill_activation_|skills_revision_conflict|workspace_skills_)/.test(error.message)
+                    ? error.message : 'skill_activation_failed',
+            }));
+        }
+    }
     const modelChanged = selected.data !== undefined && selected.data !== (found?.modelConfigId ?? recovery?.modelConfigId);
     const requestedEffort = effort.data ?? (modelChanged ? undefined : recovery?.reasoningEffort ?? found?.reasoningEffort);
     if (recovery && found?.recoverability !== 'native') {
@@ -476,11 +522,11 @@ async function executeTurn(state, scopeKey, operation, payload, recovery) {
     }
     const root = await sessionWorkspaceRoot(state, operation.workspaceId, operation.directoryName);
     try {
-        const policy = await preflightSkillExecution(state, { ...operation, payload });
+        const policy = skillActivation.data ? undefined : await preflightSkillExecution(state, { ...operation, payload });
         if (policy?.directoryAccessMode === 'exclusive' && operation.directoryAccessMode !== 'exclusive')
             throw new ComposerContextError('requires-exclusive-turn');
-        if (operation.skillExecutionPolicyVersion === 1 && (!policy ||
-            (parameterTask.data || levelEditorTask.data ? 'exclusive' : policy.directoryAccessMode) !== operation.directoryAccessMode))
+        if (!skillActivation.data && operation.skillExecutionPolicyVersion === 1 && (!policy ||
+            (parameterTask.data || levelEditorTask.data || skillActivation.data ? 'exclusive' : policy.directoryAccessMode) !== operation.directoryAccessMode))
             throw new ComposerContextError('context_skills_changed');
     }
     catch (error) {
@@ -490,9 +536,14 @@ async function executeTurn(state, scopeKey, operation, payload, recovery) {
         }));
     }
     let composer;
+    let skillActivationInstructions = '';
     let initializationSkill;
     try {
         let turnContext = selection.data.context;
+        if (activatedSkillSelection) {
+            turnContext = { files: turnContext?.files ?? [], skills: activatedSkillSelection.entries };
+            skillActivationInstructions = activatedSkillSelection.instructions;
+        }
         if (parameterTask.data?.action === 'initialize' || levelEditorTask.data) {
             const selectedSkill = await ensureParameterInitializationSkill(root, levelEditorTask.data ? 'playcraft-level-editor' : 'playcraft-runtime-parameters', levelEditorTask.data ? { preserveExisting: true } : {});
             initializationSkill = { ...selectedSkill,
@@ -512,11 +563,16 @@ async function executeTurn(state, scopeKey, operation, payload, recovery) {
         });
     }
     catch (error) {
+        const live = state.journal.getOperation(scopeKey);
+        if (skillActivation.data && live && ['failed', 'interrupted'].includes(live.status))
+            return live;
         return persist(state, scopeKey, transitionOperation(operation, 'failed', {
-            error: error instanceof ComposerContextError ? error.message : parameterTask.data?.action === 'initialize' || levelEditorTask.data
-                ? error instanceof Error && /^(?:workspace_skills_|skills_revision_conflict$)/.test(error.message)
-                    ? error.message : levelEditorTask.data ? 'level_editor_skill_unavailable' : parameterAgentError(error)
-                : 'invalid_composer_context',
+            error: skillActivation.data ? error instanceof Error && /^(?:skill_activation_|skills_revision_conflict|workspace_skills_)/.test(error.message)
+                ? error.message : 'skill_activation_failed'
+                : error instanceof ComposerContextError ? error.message : parameterTask.data?.action === 'initialize' || levelEditorTask.data
+                    ? error instanceof Error && /^(?:workspace_skills_|skills_revision_conflict$)/.test(error.message)
+                        ? error.message : levelEditorTask.data ? 'level_editor_skill_unavailable' : parameterAgentError(error)
+                    : 'invalid_composer_context',
         }));
     }
     let attachments;
@@ -567,6 +623,9 @@ async function executeTurn(state, scopeKey, operation, payload, recovery) {
         }
     }
     // Taken before the native turn exists, so nothing the agent writes can precede it.
+    const beforeStart = state.journal.getOperation(scopeKey);
+    if (skillActivation.data && beforeStart && ['failed', 'interrupted'].includes(beforeStart.status))
+        return beforeStart;
     await beginTurnChanges(state, sessionId, {
         root, workspaceId: operation.workspaceId, directoryName: binding.directoryName ?? 'basic',
     });
@@ -575,7 +634,7 @@ async function executeTurn(state, scopeKey, operation, payload, recovery) {
         const startTurn = () => native(state).startTurn({
             sessionId,
             threadId: binding.threadId,
-            text: composer.append(batchContext + context + String(body.text ?? '') + attachmentText, [engineeringBatchContext, parameterInstructions].filter(Boolean).join('\n\n')),
+            text: composer.append(batchContext + context + String(body.text ?? '') + attachmentText, [engineeringBatchContext, parameterInstructions, skillActivationInstructions].filter(Boolean).join('\n\n')),
             images: attachments.filter((file) => ['image/png', 'image/jpeg', 'image/gif', 'image/webp'].includes(file.mimeType)).map((file) => file.path),
             clientRequestId: operation.clientRequestId,
             modelConfigId: selected.data ?? binding.modelConfigId,
@@ -587,22 +646,30 @@ async function executeTurn(state, scopeKey, operation, payload, recovery) {
             scheduledTaskProposalBridge: typeof body.scheduledTaskProposalBridge === 'string' ? body.scheduledTaskProposalBridge : undefined,
             simulateLostReceipt: body.simulateLostReceipt === true,
             persistReservation: async ({ nativeRequestId, modelConfigId, reasoningEffort, permissionMode }) => {
-                const selectedEffort = reasoningEffort ?? requestedEffort;
-                const selectedMode = permissionMode ?? requestedMode;
-                await persist(state, scopeKey, {
-                    ...operation,
-                    nativeRequestId,
-                    nativeThreadId: binding.threadId,
-                    modelConfigId,
-                    reasoningEffort: selectedEffort,
-                    permissionMode: selectedMode,
-                    workMode: selection.data.workMode ?? 'execute',
-                    context: composer.context,
-                    userText: selection.data.workMode !== undefined || composer.context !== undefined || parameterTask.data || levelEditorTask.data
-                        ? String(body.userText ?? body.text ?? '') : undefined,
-                    updatedAt: new Date().toISOString(),
+                await state.journal.exclusive(`native-reservation:${operation.operationId}`, async () => {
+                    const live = state.journal.getOperation(scopeKey) ?? operation;
+                    if (live.status !== 'dispatched' || skillActivationRuntimeClosing(state) || state.journal.destroyed())
+                        throw new NativePreparationError(skillActivation.data ? 'skill_activation_cancelled' : 'native_preparation_cancelled');
+                    if ((live.leaseFence ?? 0) < state.acceptedLeaseFence || live.generation !== state.config.generation || live.runtimeEpoch !== state.runtimeEpoch)
+                        throw new NativePreparationError('stale_lease');
+                    const selectedEffort = reasoningEffort ?? requestedEffort;
+                    const selectedMode = permissionMode ?? requestedMode;
+                    await persist(state, scopeKey, {
+                        ...live,
+                        nativeRequestId,
+                        nativeThreadId: binding.threadId,
+                        modelConfigId,
+                        reasoningEffort: selectedEffort,
+                        permissionMode: selectedMode,
+                        workMode: selection.data.workMode ?? 'execute',
+                        context: composer.context,
+                        ...(activatedSkillSelection ? { skillExecutionPolicyVersion: 1 } : {}),
+                        userText: selection.data.workMode !== undefined || composer.context !== undefined || parameterTask.data || levelEditorTask.data
+                            ? String(body.userText ?? body.text ?? '') : undefined,
+                        updatedAt: new Date().toISOString(),
+                    });
+                    await state.journal.putSession({ ...binding, modelConfigId, reasoningEffort: selectedEffort, permissionMode: selectedMode, turnStatus: 'starting' });
                 });
-                await state.journal.putSession({ ...binding, modelConfigId, reasoningEffort: selectedEffort, permissionMode: selectedMode, turnStatus: 'starting' });
             },
         });
         result = await startTurn();
@@ -619,9 +686,12 @@ async function executeTurn(state, scopeKey, operation, payload, recovery) {
         }
     }
     catch (error) {
-        if (!parameterTask.data && !levelEditorTask.data)
+        if (!parameterTask.data && !levelEditorTask.data && !skillActivation.data)
             throw error;
         abandonTurnChanges(state, sessionId);
+        const live = state.journal.getOperation(scopeKey);
+        if (live && ['completed', 'failed', 'interrupted'].includes(live.status))
+            return live;
         if (error instanceof NativePreparationError) {
             await state.journal.putSession({ ...(state.journal.getSession(sessionId) ?? binding), turnStatus: undefined, turnBlock: undefined });
             return persist(state, scopeKey, transitionOperation(state.journal.getOperation(scopeKey) ?? operation, 'failed', { error: error.message }));
@@ -630,6 +700,10 @@ async function executeTurn(state, scopeKey, operation, payload, recovery) {
         return persist(state, scopeKey, transitionOperation(state.journal.getOperation(scopeKey) ?? operation, 'uncertain', { error: 'native_receipt_lost' }));
     }
     const reserved = state.journal.getOperation(scopeKey) ?? operation;
+    if (['completed', 'failed', 'interrupted'].includes(reserved.status)) {
+        abandonTurnChanges(state, sessionId);
+        return reserved;
+    }
     if (result.outcome === 'uncertain' || result.outcome === 'failed' || !result.turnId) {
         abandonTurnChanges(state, sessionId);
         const failed = result.outcome === 'failed';
@@ -952,6 +1026,25 @@ async function executeInterrupt(state, scopeKey, operation, payload) {
     // A directory-gated turn has no native turn to interrupt. Cancel only a proven pending
     // claim; an admitted/racing claim still goes through the native interruption contract.
     if (expectedTurnId === undefined && !binding.activeTurnId) {
+        const preparations = [...(nativePreparations.get(state)?.values() ?? [])].filter(item => item.operation.sessionId === sessionId && item.operation.workspaceId === operation.workspaceId
+            && (item.operation.directoryName ?? 'basic') === (operation.directoryName ?? 'basic')
+            && (!item.held || item.activation)
+            && (cancelTarget === undefined || cancelTarget === item.operation.operationId || cancelTarget === item.operation.gatewayOperationId)
+            && !state.journal.getOperationById(item.operation.operationId)?.nativeRequestId);
+        if (preparations.length === 1) {
+            const preparation = preparations[0];
+            const cancelled = await state.journal.exclusive(`native-reservation:${preparation.operation.operationId}`, async () => {
+                const live = state.journal.getOperationById(preparation.operation.operationId) ?? preparation.operation;
+                if (!['queued', 'dispatched'].includes(live.status) || live.nativeTurnId || live.nativeRequestId)
+                    return false;
+                await persist(state, preparation.scopeKey, transitionOperation(live, 'interrupted', { error: 'cancelled' }));
+                cancelSkillActivationPreparation(state, live.operationId);
+                return true;
+            });
+            if (cancelled) {
+                return persist(state, scopeKey, transitionOperation(transitionOperation(operation, 'accepted'), 'completed'));
+            }
+        }
         const candidates = state.journal.deferredDirectoryOperations().flatMap(pending => {
             const queued = state.journal.getOperationById(pending.operationId);
             return queued?.status === 'queued' && ['session.turn', 'session.review', 'session.compact'].includes(queued.kind)