@securecoms/agent-runtime 0.2.0 → 0.3.0

package/PROVENANCE.md

@@ -35,3 +35,12 @@ recognisable here. **No code was cloned from any of them.** The frontmatter
 parser in `src/skill-md.ts` is original and deliberately accepts only the
 documented subset; the built-ins are written against this package's own
 `BuiltinContext`.
+
+## Managed configuration directory (2026-09-09)
+
+`src/config-dirs.ts` and the search-path form of the persona, memory and
+skills.json readers are original to this package. The convention
+`~/.securecoms/runtime-config/<identity-id>/` is SecureComs' own: the runtime
+computes the path from the home directory and its own identity rather than
+being told it, so no path crosses a process boundary and nothing can redirect
+a configuration read. No code was cloned for this round.

package/README.md

@@ -233,13 +233,20 @@ fresh on every `http_request` call — never cached, never logged. A Postgres
 database needs the optional `pg` package installed separately
 (`npm i -g pg`); SQLite needs nothing extra (`node:sqlite`).
 
+`skills.json` may also carry a `tools` block — `{"tools": {"allow": [...],
+"deny": [...]}}` — the owner's on/off choices for the curated skills. A skill
+that is switched off is not offered to the model at all. The environment wins:
+see "Managed configuration" below.
+
 By default `skills.json` lives at `<dataDir>/skills.json`; point elsewhere
-with `SECURECOMS_SKILLS_CONFIG` or `--skills-config <path>`. A missing file
-means no endpoints, no databases and no flags — not an error.
+with `SECURECOMS_SKILLS_CONFIG` or `--skills-config <path>`. A managed copy
+(see below) wins over both. A missing file means no endpoints, no databases
+and no flags — not an error.
 
 ## Persona and memory
 
-Three optional files in the data dir make up an agent's persona, read fresh
+Three optional files make up an agent's persona, looked up along the config
+search path (see "Managed configuration" below) and read fresh
 on **every turn** — no restart needed after an edit:
 
 | File | Heading |
@@ -267,6 +274,62 @@ channel. It is capped at 8 kB; once it overflows, the **oldest** lines are
 dropped first, on the theory that the newest remembered facts are the ones
 still likely to be true.
 
+## Managed configuration (from the web app)
+
+When an agent is managed from the SecureComs web app, the owner's saved
+configuration is written to disk by the customer's daemon at:
+
+```
+~/.securecoms/runtime-config/<identity-id>/
+```
+
+The runtime reads its configuration along a **search path**: that managed
+directory first, then the data dir. The lookup is per FILE, so an owner who
+saved only `IDENTITY.md` in the app keeps the machine's own `SOUL.md`; a file
+with no managed copy still comes from the data dir, and an agent with no
+managed directory at all behaves exactly as it did before. `skills.json` is
+looked up the same way, and re-read on every turn — a new endpoint or a skill
+switched off in the app takes effect on the next message, with no restart.
+
+Two deliberate exceptions:
+
+- **The environment still wins for the tool policy.** `SECURECOMS_TOOL_ALLOW`
+  overrides the `allow` list in the `tools` block of `skills.json`, so an
+  install that pins its allow list in its service unit is unaffected by a save
+  in the app. `SECURECOMS_TOOL_DENY` is UNIONED with the file's `deny` list
+  rather than replacing it: deny is a safety mechanism, so one entry in the
+  service unit must not silently un-deny every tool the owner switched off in
+  the app. Everything the environment denies stays denied either way.
+- **Writes go to the data dir**, not the managed directory — except `MEMORY.md`,
+  which is written wherever the agent already keeps it. An existing
+  `<dataDir>/MEMORY.md` is copied into the managed directory once, at startup,
+  so the owner can read and prune it in the app.
+
+The runtime also writes `local-config.json` into the managed directory when one
+exists: what this agent's OWN persona files say, and a single boolean for
+whether it has a readable search key. It is written at startup and rewritten
+whenever the search-key answer changes, so a key file dropped in (or taken
+away) mid-run is reported without a restart. It is a report the daemon passes
+upward — nothing in the runtime reads it back, and it holds no key value.
+
+### A known limitation: the generated tool paragraph
+
+The `AGENTS.md` the app delivers ends in a generated paragraph naming the tools
+this agent has. The backend derives that list from the saved configuration plus
+the search-key boolean above; it does not see the running process. Three things
+can therefore make it diverge from what the runtime actually offers:
+
+- a `SECURECOMS_TOOL_ALLOW` or `SECURECOMS_TOOL_DENY` set in the service unit,
+  which the backend cannot see;
+- a customer skill folder whose `requires:` is narrower than the shipped one, so
+  the runtime withholds a tool the backend counted;
+- a custom skill the backend knows nothing about, so it is offered but unnamed.
+
+In any of those cases the paragraph is advisory rather than exact. The gate is
+still authoritative — a tool named in the paragraph but denied by policy is
+still refused at call time — so the risk is a wrong claim in conversation, not
+a wrong permission.
+
 ## Provenance
 
 See [PROVENANCE.md](./PROVENANCE.md) for which files were ported from

package/dist/bin.js

@@ -3,10 +3,10 @@
 // src/index.ts
 import { readFileSync as readFileSync9 } from "node:fs";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
-import { dirname as dirname4, join as join7 } from "node:path";
+import { dirname as dirname4, join as join8 } from "node:path";
 import { spawnSync } from "node:child_process";
-import { accessSync, constants, existsSync as existsSync6, mkdirSync as mkdirSync3, realpathSync, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { homedir as homedir3, userInfo } from "node:os";
+import { accessSync, constants, existsSync as existsSync7, mkdirSync as mkdirSync3, realpathSync, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { homedir as homedir4, userInfo } from "node:os";
 
 // src/config.ts
 import { homedir } from "node:os";
@@ -95,7 +95,11 @@ function loadConfig(argv, env) {
     dataDir,
     skillsConfigPath: parseStringFlag(argv, "--skills-config", env, "SECURECOMS_SKILLS_CONFIG") ?? join(dataDir, "skills.json"),
     logLevel,
-    toolGate
+    toolGate,
+    toolGateEnv: {
+      ...parsedAllow !== void 0 ? { allow: parsedAllow } : {},
+      ...deny !== void 0 ? { deny } : {}
+    }
   };
 }
 
@@ -604,8 +608,8 @@ ${memories}`;
 };
 
 // src/skill-invoker.ts
-import { readFileSync as readFileSync6, readdirSync, existsSync as existsSync4, statSync } from "node:fs";
-import { join as join4 } from "node:path";
+import { readFileSync as readFileSync6, readdirSync, existsSync as existsSync5, statSync } from "node:fs";
+import { join as join5 } from "node:path";
 
 // src/skill-md.ts
 var SkillMdError = class extends Error {
@@ -760,13 +764,33 @@ function resolveRequires(req, env) {
 }
 
 // src/skills-config.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "node:fs";
 import { isAbsolute as isAbsolute2, resolve as resolve2 } from "node:path";
+
+// src/config-dirs.ts
+import { existsSync as existsSync2 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join3 } from "node:path";
+function managedConfigDir(identityId, home = homedir2()) {
+  return join3(home, ".securecoms", "runtime-config", identityId);
+}
+function configSearchPath(identityId, dataDir, home = homedir2()) {
+  return [managedConfigDir(identityId, home), dataDir];
+}
+function findConfigFile(name, dirs) {
+  for (const dir of dirs) {
+    const path = join3(dir, name);
+    if (existsSync2(path)) return path;
+  }
+  return null;
+}
+
+// src/skills-config.ts
 var EMPTY_SKILLS_CONFIG = { endpoints: {}, databases: {}, flags: [] };
 var empty = () => ({ endpoints: {}, databases: {}, flags: [] });
 var abs2 = (p, dataDir) => isAbsolute2(p) ? p : resolve2(dataDir, p);
-function loadSkillsConfig(path, dataDir) {
-  if (!existsSync2(path)) return empty();
+function loadSkillsConfigFile(path, dataDir) {
+  if (!existsSync3(path)) return empty();
   let raw;
   try {
     raw = JSON.parse(readFileSync2(path, "utf8"));
@@ -800,7 +824,13 @@ function loadSkillsConfig(path, dataDir) {
     } else console.warn(`[skills-config] database "${name}" in ${path} needs sqlite or postgresUrlFile; skipped`);
   }
   const flags = Array.isArray(src.flags) ? src.flags.filter((f) => typeof f === "string") : [];
-  return { endpoints, databases, flags };
+  const strings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : void 0;
+  const rawTools = src.tools ?? void 0;
+  const tools = rawTools ? {
+    ...strings(rawTools.allow) ? { allow: strings(rawTools.allow) } : {},
+    ...strings(rawTools.deny) ? { deny: strings(rawTools.deny) } : {}
+  } : void 0;
+  return { endpoints, databases, flags, ...tools ? { tools } : {} };
 }
 
 // src/builtins/current-time.ts
@@ -1076,33 +1106,43 @@ var httpRequest = async (args, ctx) => {
 };
 
 // src/long-term-memory.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join3 } from "node:path";
+import { copyFileSync, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join4 } from "node:path";
 var MEMORY_FILE = "MEMORY.md";
 var MEMORY_MAX_BYTES = 8192;
 var FACT_MAX_CHARS = 300;
-function memoryPath(dataDir) {
-  return join3(dataDir, MEMORY_FILE);
-}
-function readLongTermMemory(dataDir) {
-  const p = memoryPath(dataDir);
-  if (!existsSync3(p)) return null;
+function readLongTermMemory(dirs) {
+  const p = findConfigFile(MEMORY_FILE, dirs);
+  if (!p) return null;
   const body = readFileSync4(p, "utf8").trim();
   return body || null;
 }
-function rememberFact(dataDir, fact, now) {
+function memoryTarget(dirs) {
+  for (const d of dirs) if (existsSync4(join4(d, MEMORY_FILE))) return d;
+  for (const d of dirs) if (existsSync4(d)) return d;
+  return dirs[dirs.length - 1];
+}
+function migrateMemoryIntoManaged(managedDir, dataDir) {
+  const managed = join4(managedDir, MEMORY_FILE);
+  const local = join4(dataDir, MEMORY_FILE);
+  if (!existsSync4(managedDir) || existsSync4(managed) || !existsSync4(local)) return false;
+  copyFileSync(local, managed);
+  return true;
+}
+function rememberFact(dirs, fact, now) {
   const clean = fact.replace(/\s+/g, " ").trim().slice(0, FACT_MAX_CHARS);
   if (!clean) throw new Error("remember needs a non-empty fact");
   const line = `- ${now.toISOString().slice(0, 10)} ${clean}`;
-  mkdirSync2(dataDir, { recursive: true });
-  const existing = readLongTermMemory(dataDir);
+  const dir = memoryTarget(dirs);
+  mkdirSync2(dir, { recursive: true });
+  const existing = readLongTermMemory(dirs);
   let lines = existing ? existing.split("\n") : [];
   lines.push(line);
   while (Buffer.byteLength(`${lines.join("\n")}
 `, "utf8") > MEMORY_MAX_BYTES && lines.length > 1) {
     lines = lines.slice(1);
   }
-  writeFileSync2(memoryPath(dataDir), `${lines.join("\n")}
+  writeFileSync2(join4(dir, MEMORY_FILE), `${lines.join("\n")}
 `, { mode: 384 });
   return line;
 }
@@ -1110,7 +1150,7 @@ function rememberFact(dataDir, fact, now) {
 // src/builtins/remember.ts
 var remember = async (args, ctx) => {
   try {
-    return JSON.stringify({ remembered: rememberFact(ctx.dataDir, String(args.fact ?? ""), ctx.now()) });
+    return JSON.stringify({ remembered: rememberFact(ctx.configDirs, String(args.fact ?? ""), ctx.now()) });
   } catch (e) {
     return toolError(e instanceof Error ? e.message : String(e));
   }
@@ -1314,6 +1354,7 @@ function offlineContext() {
   };
   return {
     dataDir: "",
+    configDirs: [""],
     readKeyFile: () => null,
     fetch: refuse,
     resolve: async () => refuse(),
@@ -1356,19 +1397,19 @@ var SkillInvoker = class {
    * `<skillsDir>/<subdir>/manifest.json`.
    */
   loadSkills() {
-    if (!existsSync4(this.skillsDir)) {
+    if (!existsSync5(this.skillsDir)) {
       console.warn(`[SkillInvoker] Skills directory not found: ${this.skillsDir}`);
       return;
     }
     const flat = [], manifests = [], skillMds = [];
     for (const entry of readdirSync(this.skillsDir, { withFileTypes: true })) {
       if (entry.isFile() && entry.name.endsWith(".json")) {
-        flat.push(join4(this.skillsDir, entry.name));
+        flat.push(join5(this.skillsDir, entry.name));
       } else if (entry.isDirectory()) {
-        const m = join4(this.skillsDir, entry.name, "manifest.json");
-        if (existsSync4(m) && statSync(m).isFile()) manifests.push(m);
-        const s = join4(this.skillsDir, entry.name, "SKILL.md");
-        if (existsSync4(s) && statSync(s).isFile()) skillMds.push(s);
+        const m = join5(this.skillsDir, entry.name, "manifest.json");
+        if (existsSync5(m) && statSync(m).isFile()) manifests.push(m);
+        const s = join5(this.skillsDir, entry.name, "SKILL.md");
+        if (existsSync5(s) && statSync(s).isFile()) skillMds.push(s);
       }
     }
     for (const p of [...flat.sort(), ...manifests.sort()]) this.loadManifestFile(p);
@@ -1537,12 +1578,27 @@ function createLocalToolGate(policy) {
     }
   };
 }
+function resolveToolPolicy(env, file, defaults) {
+  const deny = env.deny || file?.deny ? [.../* @__PURE__ */ new Set([...env.deny ?? [], ...file?.deny ?? []])] : void 0;
+  return {
+    default: defaults.default,
+    allow: env.allow ?? file?.allow ?? defaults.allow,
+    ...deny ? { deny } : {}
+  };
+}
+function createDynamicToolGate(policyFor) {
+  return {
+    gate(toolName) {
+      return createLocalToolGate(policyFor()).gate(toolName);
+    }
+  };
+}
 
 // src/data-plane.ts
 import { readFileSync as readFileSync7 } from "node:fs";
 import { WebSocket } from "node:http";
-import { homedir as homedir2 } from "node:os";
-import { join as join5 } from "node:path";
+import { homedir as homedir3 } from "node:os";
+import { join as join6 } from "node:path";
 var SEEN_MAX = 5e3;
 function errText(e) {
   return e instanceof Error ? e.message : String(e);
@@ -1585,8 +1641,8 @@ var SecureComsDataPlane = class {
   generation = 0;
   constructor(cfg, onMessage) {
     this.identityId = cfg.identityId;
-    const dir = cfg.connectionsDir ?? join5(homedir2(), ".securecoms", "connections");
-    this.connectionPath = join5(dir, `${cfg.identityId}.json`);
+    const dir = cfg.connectionsDir ?? join6(homedir3(), ".securecoms", "connections");
+    this.connectionPath = join6(dir, `${cfg.identityId}.json`);
     this.establishedMs = cfg.establishedMs ?? 5e3;
     this.initialDelayMs = cfg.initialDelayMs ?? 250;
     this.maxDelayMs = cfg.maxDelayMs ?? 3e4;
@@ -1901,8 +1957,8 @@ ${longTerm}` });
 }
 
 // src/persona.ts
-import { existsSync as existsSync5, readFileSync as readFileSync8 } from "node:fs";
-import { dirname as dirname3, join as join6 } from "node:path";
+import { existsSync as existsSync6, readFileSync as readFileSync8, renameSync, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname3, join as join7 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var PERSONA_MAX_BYTES = 8192;
 var PERSONA_SOURCES = [
@@ -1918,17 +1974,17 @@ var SAFETY_PREAMBLE = [
   "- Only use the tools you were given; do not invent capabilities."
 ].join("\n");
 function defaultPersonaDir() {
-  return join6(dirname3(fileURLToPath2(import.meta.url)), "..", "persona");
+  return join7(dirname3(fileURLToPath2(import.meta.url)), "..", "persona");
 }
 function assemblePrompt(parts) {
   return parts.map((p) => `${p.heading}
 ${p.body}`).join("\n\n");
 }
-function loadPersona(dataDir) {
+function loadPersona(dirs) {
   const parts = [];
   for (const { file, heading } of PERSONA_SOURCES) {
-    const path = join6(dataDir, file);
-    if (!existsSync5(path)) continue;
+    const path = findConfigFile(file, dirs);
+    if (!path) continue;
     let body;
     try {
       body = readFileSync8(path, "utf8");
@@ -1945,25 +2001,66 @@ function loadPersona(dataDir) {
   }
   return parts.length ? assemblePrompt(parts) : null;
 }
-function systemPromptFor(dataDir, fallback) {
-  return `${loadPersona(dataDir) ?? fallback}
+function systemPromptFor(dirs, fallback) {
+  return `${loadPersona(dirs) ?? fallback}
 
 ${SAFETY_PREAMBLE}`;
 }
+function writeLocalConfigReport(managedDir, dataDir, now, hasSearchKey) {
+  if (!existsSync6(managedDir)) return false;
+  const persona = {};
+  for (const { file } of PERSONA_SOURCES) {
+    const path2 = join7(dataDir, file);
+    if (!existsSync6(path2)) continue;
+    try {
+      persona[file] = readFileSync8(path2, "utf8").slice(0, PERSONA_MAX_BYTES);
+    } catch {
+    }
+  }
+  const doc = {
+    schema: "securecoms.local-config/1",
+    written_at: now.toISOString(),
+    has_search_key: hasSearchKey,
+    persona
+  };
+  const path = join7(managedDir, "local-config.json");
+  const tmp = `${path}.${process.pid}.tmp`;
+  try {
+    writeFileSync3(tmp, `${JSON.stringify(doc, null, 2)}
+`, { mode: 384 });
+    renameSync(tmp, path);
+  } catch (e) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+    throw e;
+  }
+  return true;
+}
 function personaInit(dataDir, defaultsDir, writeFile, exists) {
   const written = [];
   const skipped = [];
   for (const { file } of PERSONA_SOURCES) {
-    const target = join6(dataDir, file);
+    const target = join7(dataDir, file);
     if (exists(target)) {
       skipped.push(target);
       continue;
     }
-    writeFile(target, readFileSync8(join6(defaultsDir, file), "utf8"));
+    writeFile(target, readFileSync8(join7(defaultsDir, file), "utf8"));
     written.push(target);
   }
   return { written, skipped };
 }
+function createLocalConfigReporter(managedDir, dataDir, now) {
+  let lastWritten = null;
+  return (hasSearchKey) => {
+    if (lastWritten === hasSearchKey) return false;
+    const wrote = writeLocalConfigReport(managedDir, dataDir, now(), hasSearchKey);
+    if (wrote) lastWritten = hasSearchKey;
+    return wrote;
+  };
+}
 
 // src/warning-filter.ts
 function installWarningFilter(proc = process) {
@@ -1978,7 +2075,7 @@ function installWarningFilter(proc = process) {
 
 // src/index.ts
 if (process.argv.includes("--version")) {
-  const pkg = JSON.parse(readFileSync9(join7(dirname4(dirname4(fileURLToPath3(import.meta.url))), "package.json"), "utf8"));
+  const pkg = JSON.parse(readFileSync9(join8(dirname4(dirname4(fileURLToPath3(import.meta.url))), "package.json"), "utf8"));
   console.log(pkg.version);
   process.exit(0);
 }
@@ -2009,10 +2106,10 @@ function realServiceDeps() {
       const r = spawnSync(cmd, args, { encoding: "utf8" });
       return { status: r.status ?? 1, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
     },
-    writeFile: (p, data) => writeFileSync3(p, data, { mode: 420 }),
+    writeFile: (p, data) => writeFileSync4(p, data, { mode: 420 }),
     removeFile: (p) => rmSync(p, { force: true }),
     mkdirp: (p) => mkdirSync3(p, { recursive: true }),
-    fileExists: (p) => existsSync6(p),
+    fileExists: (p) => existsSync7(p),
     canRead: (p) => {
       try {
         accessSync(p, constants.R_OK);
@@ -2027,7 +2124,7 @@ function realServiceDeps() {
 function realResolveNodeDeps() {
   return {
     realpath: (p) => realpathSync(p),
-    fileExists: (p) => existsSync6(p),
+    fileExists: (p) => existsSync7(p),
     nodeMajorOf: (p) => {
       const r = spawnSync(p, ["--version"], { encoding: "utf8" });
       if (r.status !== 0) return null;
@@ -2047,7 +2144,7 @@ function runServiceVerb(verb) {
     console.error(`securecoms-agent: ${MISSING_IDENTITY_MESSAGE}`);
     process.exit(2);
   }
-  const home = homedir3();
+  const home = homedir4();
   try {
     const execPath = chooseVerbExecPath(
       verb,
@@ -2123,13 +2220,18 @@ async function main() {
       const r = personaInit(
         cfgForPersona.dataDir,
         defaultPersonaDir(),
-        (p, d) => writeFileSync3(p, d, { mode: 384 }),
-        (p) => existsSync6(p)
+        (p, d) => writeFileSync4(p, d, { mode: 384 }),
+        (p) => existsSync7(p)
       );
       for (const p of r.written) console.log(`wrote ${p}`);
       for (const p of r.skipped) console.log(`kept ${p} (already exists)`);
     } else {
-      console.log(systemPromptFor(cfgForPersona.dataDir, DEFAULT_SYSTEM_PROMPT));
+      console.log(
+        systemPromptFor(
+          configSearchPath(cfgForPersona.identityId, cfgForPersona.dataDir),
+          DEFAULT_SYSTEM_PROMPT
+        )
+      );
     }
     process.exit(0);
   }
@@ -2155,7 +2257,7 @@ async function main() {
   const memoryFor = (channelId) => {
     let mem = memories.get(channelId);
     if (!mem) {
-      mem = new AgentMemory(join7(cfg.dataDir, "channels", safeChannelSegment(channelId)));
+      mem = new AgentMemory(join8(cfg.dataDir, "channels", safeChannelSegment(channelId)));
       memories.set(channelId, mem);
     }
     return mem;
@@ -2170,24 +2272,45 @@ async function main() {
       return null;
     }
   };
+  const configDirs = configSearchPath(cfg.identityId, cfg.dataDir);
+  const managedDir = managedConfigDir(cfg.identityId);
+  const hasSearchKey = () => hasReadableKeyFile([cfg.braveKeyFile, cfg.tavilyKeyFile], (p) => readFileSync9(p, "utf8"));
+  migrateMemoryIntoManaged(managedDir, cfg.dataDir);
+  const reportLocalConfig = createLocalConfigReporter(managedDir, cfg.dataDir, () => /* @__PURE__ */ new Date());
+  reportLocalConfig(hasSearchKey());
+  const currentSkillsConfig = () => {
+    const managed = findConfigFile("skills.json", [managedDir]);
+    return managed ? loadSkillsConfigFile(managed, cfg.dataDir) : loadSkillsConfigFile(cfg.skillsConfigPath, cfg.dataDir);
+  };
   const builtinCtx = {
     dataDir: cfg.dataDir,
+    configDirs,
     readKeyFile,
     fetch,
     resolve: systemResolver(),
-    skillsConfig: loadSkillsConfig(cfg.skillsConfigPath, cfg.dataDir),
+    get skillsConfig() {
+      return currentSkillsConfig();
+    },
     now: () => /* @__PURE__ */ new Date(),
     log
   };
   const skills = new SkillInvoker(cfg.skillsDir, builtinCtx);
   skills.loadSkills();
-  const skillsConfig = builtinCtx.skillsConfig;
-  const hasSearchKey = () => hasReadableKeyFile([cfg.braveKeyFile, cfg.tavilyKeyFile], (p) => readFileSync9(p, "utf8"));
-  const requiresEnv = requiresEnvFrom(skillsConfig, hasSearchKey());
-  for (const held of skills.unavailable(requiresEnv)) {
+  const policyFor = () => resolveToolPolicy(cfg.toolGateEnv, currentSkillsConfig().tools, {
+    default: cfg.toolGate.default,
+    allow: DEFAULT_TOOL_ALLOW
+  });
+  const gate = createDynamicToolGate(policyFor);
+  const offeredTools = () => {
+    const sc = currentSkillsConfig();
+    const g = createLocalToolGate(policyFor());
+    const searchKey = hasSearchKey();
+    reportLocalConfig(searchKey);
+    return skills.available(requiresEnvFrom(sc, searchKey)).filter((t) => g.gate(t.function.name).allowed);
+  };
+  for (const held of skills.unavailable(requiresEnvFrom(currentSkillsConfig(), hasSearchKey()))) {
     console.log(`unavailable: ${held.name} (missing ${held.missing.join(", ")})`);
   }
-  const gate = createLocalToolGate(cfg.toolGate);
   const plane = createSecureComsDataPlane(
     { identityId: cfg.identityId, log: (level, msg) => log(level, msg) },
     buildHandler({
@@ -2196,16 +2319,16 @@ async function main() {
       skills,
       gate,
       log,
-      // All three are read PER TURN: a persona edit, a new remembered fact, or
-      // a key file dropped in while the agent runs takes effect on the next
-      // message, with no restart.
-      systemPromptFor: () => systemPromptFor(cfg.dataDir, DEFAULT_SYSTEM_PROMPT),
-      longTermMemory: () => readLongTermMemory(cfg.dataDir),
-      tools: () => skills.available(requiresEnvFrom(skillsConfig, hasSearchKey()))
+      // All of these are read PER TURN: a persona edit, a new remembered fact, a
+      // key file dropped in, or configuration saved in the web app takes effect
+      // on the next message, with no restart.
+      systemPromptFor: () => systemPromptFor(configDirs, DEFAULT_SYSTEM_PROMPT),
+      longTermMemory: () => readLongTermMemory(configDirs),
+      tools: offeredTools
     })
   );
   console.log(
-    `securecoms-agent ${cfg.identityId.slice(0, 8)} \u2192 llm ${endpointHost(cfg.llmEndpoint)} (${cfg.llmModel}), ${skills.available(requiresEnv).length} skills, tool gate default=${cfg.toolGate.default}`
+    `securecoms-agent ${cfg.identityId.slice(0, 8)} \u2192 llm ${endpointHost(cfg.llmEndpoint)} (${cfg.llmModel}), ${offeredTools().length} skills, tool gate default=${cfg.toolGate.default}`
   );
   await plane.start();
   const shutdown = () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securecoms/agent-runtime",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "type": "module",
   "bin": {
     "securecoms-agent": "dist/bin.js"