@rowan-agent/agent 0.9.0 → 0.9.2

package/dist/index.d.ts

@@ -590,6 +590,10 @@ type AgentContext = {
     phases?: PhaseRegistry;
 };
 
+/**
+ * `root` anchors relative paths and the Bash working directory. It is not a
+ * filesystem sandbox: core Tools use the permissions of the host process.
+ */
 type CoreToolContext = {
     root?: string;
     maxReadBytes?: number;
@@ -607,6 +611,8 @@ type AgentDefinition = Readonly<{
     prompt: string;
     tools?: readonly string[];
     skills?: readonly string[];
+    /** Host-supplied Skills private to this Agent Definition/Bundle. */
+    bundledSkills?: readonly Skill[];
     phases?: PhaseRegistrySelection;
     contexts?: readonly string[];
     model?: ModelRef;

package/dist/index.js

@@ -1,6 +1,6 @@
 // src/harness/tools/index.ts
 import { mkdir, readFile as readFile2, stat, writeFile } from "fs/promises";
-import { basename as basename2, dirname as dirname2, isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2, sep as sep2 } from "path";
+import { basename as basename2, dirname as dirname2, relative as relative2, resolve as resolve2 } from "path";
 import Type2 from "typebox";
 import Schema from "typebox/schema";
 
@@ -308,9 +308,6 @@ function resolveCoreToolPath(context, path = ".") {
   const inputPath = normalizeCoreToolInputPath(path);
   const absolutePath = resolve2(root, inputPath);
   const relativePath = relative2(root, absolutePath);
-  if (relativePath === ".." || relativePath.startsWith(`..${sep2}`) || isAbsolute2(relativePath)) {
-    throw new Error(`Path escapes workspace root: ${path}`);
-  }
   return {
     root,
     inputPath,
@@ -465,7 +462,7 @@ async function captureStream(stream, maxBytes) {
 function createReadTool(context) {
   return {
     name: "read",
-    description: "Read a file in the workspace.",
+    description: "Read a file using the host process filesystem permissions.",
     parameters: ReadArgsSchema,
     promptSnippet: "Read file contents.",
     promptGuidelines: ["Read files before editing them."],
@@ -536,7 +533,7 @@ function createReadTool(context) {
 function createWriteTool(context) {
   return {
     name: "write",
-    description: "Create or overwrite a file in the workspace.",
+    description: "Create or overwrite a file using the host process filesystem permissions.",
     parameters: WriteArgsSchema,
     promptSnippet: "Create or overwrite files.",
     promptGuidelines: ["Use edit for partial changes."],
@@ -588,7 +585,7 @@ function applyEditReplacements(current, edits) {
 function createEditTool(context) {
   return {
     name: "edit",
-    description: "Apply exact text replacements to a workspace file.",
+    description: "Apply exact text replacements using the host process filesystem permissions.",
     parameters: EditArgsSchema,
     promptSnippet: "Apply exact text replacements.",
     promptGuidelines: ["Read the file first; each oldText must match exactly once."],
@@ -624,7 +621,7 @@ function createEditTool(context) {
 function createBashTool(context) {
   return {
     name: "bash",
-    description: "Run a bash command in the workspace.",
+    description: "Run a bash command with the host process filesystem permissions; root is the working directory.",
     parameters: BashArgsSchema,
     promptSnippet: "Run shell commands.",
     promptGuidelines: ["Use read/write/edit for file operations."],
@@ -1049,6 +1046,7 @@ function assertAgentDefinition(value) {
   requiredString(value.prompt, "definition.prompt");
   optionalStringList(value.tools, "definition.tools");
   optionalStringList(value.skills, "definition.skills");
+  optionalBundledSkills(value.bundledSkills, "definition.bundledSkills");
   optionalPhaseRegistrySelection(value.phases, "definition.phases");
   optionalStringList(value.contexts, "definition.contexts");
   if ("extensions" in value) throw new TypeError("definition.extensions is not supported; Extensions are Runtime-global");
@@ -1120,6 +1118,19 @@ function optionalStringList(value, field) {
   }
   return names;
 }
+function optionalBundledSkills(value, field) {
+  if (value === void 0) return;
+  if (!Array.isArray(value)) throw new TypeError(`${field} must be an array of Skills`);
+  const names = /* @__PURE__ */ new Set();
+  for (const [index, item] of value.entries()) {
+    if (!isRecord(item) || typeof item.name !== "string" || item.name.trim() === "" || typeof item.description !== "string" || typeof item.filePath !== "string" || typeof item.baseDir !== "string" || typeof item.content !== "string" || typeof item.disableModelInvocation !== "boolean") {
+      throw new TypeError(`${field}[${index}] is invalid`);
+    }
+    if (names.has(item.name)) throw new TypeError(`Duplicate bundled Skill "${item.name}".`);
+    names.add(item.name);
+  }
+  return value;
+}
 function optionalPhaseRegistrySelection(value, field) {
   if (value === void 0) return void 0;
   if (!isRecord(value)) throw new TypeError(`${field} must be an object`);
@@ -1514,6 +1525,13 @@ function selectNamedResources(candidates, names, kind) {
   }
   return selected;
 }
+function mergeSkills(...layers) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const layer of layers) {
+    for (const skill of layer ?? []) byName.set(skill.name, skill);
+  }
+  return [...byName.values()];
+}
 
 // src/harness/context/system-prompt.ts
 function buildSystemPrompt(options) {
@@ -1540,7 +1558,7 @@ function buildSystemPrompt(options) {
   }
   const guidelines = guidelinesList.map((g) => `- ${g}`).join("\n");
   const skillsSection = skillsBlock ? `The following skills provide specialized instructions for specific tasks.
-Read the full skill file when the task matches its description.
+Use the read tool to load a skill's file when the task matches its description.
 When a skill file references a relative path, resolve it against the skill directory (parent of SKILL.md) and use that absolute path in tool commands.
 
 ${skillsBlock}
@@ -2043,7 +2061,7 @@ async function runPhaseLoop(config, state, registry) {
     const toolExecutionManager = createToolExecutionManager();
     const execution = createPhaseExecution(config, state, phase, messageManager, toolExecutionManager, registry);
     const phaseTools = selectPhaseTools(allTools, phase.tools);
-    const phaseSkills = phase.name === DEFAULT_PHASE_ID ? config.context.skills : phase.skills ?? [];
+    const phaseSkills = mergeSkills(config.context.skills, phase.skills);
     let phaseContext = {
       systemPrompt: config.context.systemPrompt,
       messages: messageManager.visible(),
@@ -2534,7 +2552,7 @@ async function executeParallelPhase(config, state, registry, phase, payload, con
   const messages = [...context];
   const allTools = buildToolsWithRouting(config, availablePhases);
   const phaseTools = selectPhaseTools(allTools, phase.tools);
-  const phaseSkills = phase.name === DEFAULT_PHASE_ID ? config.context.skills : phase.skills ?? [];
+  const phaseSkills = mergeSkills(config.context.skills, phase.skills);
   const systemPrompt = config.context.systemPrompt;
   const phaseContext = {
     systemPrompt,
@@ -3016,6 +3034,9 @@ function snapshotConfig(config) {
     ...config.definition,
     ...config.definition.tools ? { tools: Object.freeze([...config.definition.tools]) } : {},
     ...config.definition.skills ? { skills: Object.freeze([...config.definition.skills]) } : {},
+    ...config.definition.bundledSkills ? {
+      bundledSkills: Object.freeze(config.definition.bundledSkills.map((skill) => Object.freeze({ ...skill })))
+    } : {},
     ...config.definition.phases ? {
       phases: Object.freeze({
         entryPhaseId: config.definition.phases.entryPhaseId,
@@ -3494,10 +3515,9 @@ function resolveDefinitionContext(config, assembled = {}) {
     config.definition.tools,
     "Tool"
   );
-  const skills = selectNamedResources(
-    config.resources.skills,
-    config.definition.skills,
-    "Skill"
+  const skills = mergeSkills(
+    selectNamedResources(config.resources.skills, config.definition.skills, "Skill"),
+    config.definition.bundledSkills
   );
   const contexts = selectNamedResources(
     config.resources.contexts ?? [],
@@ -4691,6 +4711,13 @@ var ResourceRegistry = class {
   }
 };
 function snapshotResourceValue(kind, value) {
+  if (kind === "agent") {
+    const agent = value;
+    return Object.freeze({
+      ...agent,
+      ...agent.bundledSkills ? { bundledSkills: Object.freeze(agent.bundledSkills.map((skill) => Object.freeze({ ...skill }))) } : {}
+    });
+  }
   if (kind !== "phase") return value;
   const phase = value;
   const snapshot = {
@@ -4964,7 +4991,10 @@ function resolveConfigurationSnapshot(registry, input) {
   const layer = input.definition.layer;
   const definition = applyDefinitionLayer(base, layer);
   const tools = selectNamedResources(resolved.tools, definition.tools, "Tool");
-  const skills = selectNamedResources(resolved.skills, definition.skills, "Skill");
+  const skills = mergeSkills(
+    selectNamedResources(resolved.skills, definition.skills, "Skill"),
+    definition.bundledSkills
+  );
   const phases = resolvePhases(resolved.phases, definition.phases);
   const contexts = selectNamedResources(input.contexts ?? [], base.contexts, "Context");
   return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rowan-agent/agent",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "license": "MIT",
   "repository": {
     "type": "git",