@sema-agent/core 7.40.1 → 7.41.0

package/dist/core/skill-grant.d.ts

@@ -0,0 +1,239 @@
+import type { PermissionResult, ToolCallRequest } from "./tool-policy.js";
+import { type PersistedRule } from "./permission-rule-model.js";
+import type { PermissionMode } from "./ask-origin.js";
+import { type PermissionSeatInputs, type PermissionSeatReading } from "./mode-policy.js";
+import type { AgentTool } from "../internal/harness-types.js";
+import type { EngineNotice } from "./engine-notice.js";
+/** Who wrote a row: the `Skill` tool on a successful activation, prepare for a skill the person invoked by name, or a
+ *  delegated child's seed from its parent. */
+export declare const SKILL_GRANT_ORIGINS: readonly ["model", "user", "inherited"];
+export type SkillGrantOrigin = (typeof SKILL_GRANT_ORIGINS)[number];
+/** The PORTABLE form of one row — what a delegated child captures and what a park checkpoint section freezes: the
+ *  skill, the list it came from, and the entry as the skill spells it. The compiled reading is re-derived wherever a
+ *  record is seeded (never trusted off the record). */
+export interface SkillGrantRecord {
+    readonly skill: string;
+    readonly behavior: "allow" | "deny";
+    readonly entry: string;
+    readonly origin?: SkillGrantOrigin;
+}
+/** Why an entry grants (or refuses) nothing — the closed set the start-of-run notice names. */
+export declare const SKILL_ENTRY_INERT_REASONS: readonly ["wildcard_all", "namespace_wildcard", "path_pattern", "domain", "content_unsupported", "grammar"];
+export type SkillEntryInertReason = (typeof SKILL_ENTRY_INERT_REASONS)[number];
+/** One entry the grammar reads (kind closed): a whole non-shell tool; a protocol namespace; the whole shell tool; a shell
+ *  command rule (`interpreter` = an interpreter-headed open prefix); the Read directory form; a deny-side path pattern. */
+type CompiledEntry = {
+    readonly kind: "tool";
+    readonly name: string;
+} | {
+    readonly kind: "namespace";
+    readonly pattern: string;
+} | {
+    readonly kind: "shell";
+    readonly name: string;
+} | {
+    readonly kind: "command";
+    readonly rule: PersistedRule;
+    readonly interpreter: boolean;
+} | {
+    readonly kind: "read_dir";
+    readonly rule: PersistedRule;
+} | {
+    readonly kind: "path";
+    readonly rule: PersistedRule;
+};
+/** One row of the table. */
+export interface SkillGrantRow {
+    readonly skill: string;
+    readonly origin: SkillGrantOrigin;
+    readonly behavior: "allow" | "deny";
+    readonly entry: string;
+    readonly compiled: CompiledEntry;
+}
+/** An entry the grammar reads as granting or refusing nothing. */
+export interface SkillInertEntry {
+    readonly skill: string;
+    readonly list: "allowed-tools" | "disallowed-tools";
+    readonly entry: string;
+    readonly reason: SkillEntryInertReason;
+}
+/** The two lists a skill declares (the shape of a `SkillSpec`, read by name). */
+export interface SkillGrantSource {
+    readonly name: string;
+    readonly allowedTools?: readonly string[];
+    readonly disallowedTools?: readonly string[];
+}
+/**
+ * The skill a `Skill` call's arguments name among `skills`: the definition whose `name` equals `args.skill` exactly —
+ * case-sensitive, no alias, no trimming, first of a name (a prepared table is already deduplicated) — or undefined (no such
+ * name, or a `skill` member that is not a string). The ONE resolution: the `Skill` tool activates through it, the card is
+ * asked through it ({@link skillSeatReader}), a parked approval is bound and judged through it ({@link skillGrantDigest}) and
+ * the person's invoked names are read through it ({@link seedSkillGrants}).
+ */
+export declare function skillNamedBy<T extends Pick<SkillGrantSource, "name">>(args: unknown, skills: readonly T[]): T | undefined;
+/**
+ * The digest of what a Skill card disclosed — `Execute skill: <name>` and the lists approving it releases: the skill's name
+ * as the table spells it ({@link skillNamedBy} resolved it, so it equals the call's `skill` exactly) and its two lists in the
+ * rule grammar's canonical spelling (`Tool()` / `Tool(*)` read as the bare name), de-duplicated and sorted, hashed as the
+ * approval binding is hashed (`boundInputHashOf`). `undefined` — no skill named — digests as a nameless skill declaring
+ * nothing (activating it grants nothing). Any change to the name or to either list changes it; the body does not. The read
+ * point a parked Skill approval binds to (stored beside the row's input binding, compared before the resumed activation).
+ */
+export declare function skillGrantDigest(skill: Pick<SkillGrantSource, "name" | "allowedTools" | "disallowedTools"> | undefined): string;
+/**
+ * The digest a parked call to the engine's `Skill` tool binds — written by the park beside the row's input binding — or
+ * undefined for any other call, and when no skill is loaded (no engine `Skill` tool is mounted, so a call by that name is
+ * not an activation).
+ */
+export declare function skillCallGrantDigest(call: {
+    readonly toolName: string;
+}, args: unknown, skills: readonly SkillGrantSource[], skillToolName: string): string | undefined;
+/**
+ * The approving resume of a parked call, judged against the card it was asked under. A row is a `Skill` approval when it
+ * carries a digest (the park said so), or when the resume would run the engine's `Skill` tool on it (skills loaded, the
+ * row's wire name). For such a row: the refusal sentence when the skill the arguments name — as the resume's skills define
+ * it, none loaded included — does not digest as the row's `boundGrantDigest`, or the row carries none (parked before the
+ * binding); undefined otherwise. ONE judgement (the digest), judged at two sites: the claim (`site: "claim"`, the decided
+ * bytes — the row stays pending: deny it, then activate again) and the resumed execution boundary (`site: "execution"`, the
+ * bytes that will run, after every station that can rewrite them — the approval is spent: the call does not run). The
+ * sentence says which side of the digest differs, read off the row's own arguments: the arguments name another skill than
+ * the card's (`row.args`), or the card's skill no longer declares the lists the card showed (or is not served). Names the
+ * skills, never a path; says the way out.
+ */
+export declare function parkedSkillApprovalRefusal(row: {
+    readonly toolName: string;
+    readonly args: unknown;
+    readonly boundGrantDigest?: string;
+}, args: unknown, skills: readonly SkillGrantSource[], skillToolName: string, site?: "claim" | "execution"): string | undefined;
+/** A resume's skills read ONCE: each definition copied with its two lists, so the parked Skill approval's binding and the
+ *  resumed leg's prepare read one value — a later edit to the caller's own objects or arrays reaches neither. */
+export declare function detachSkillLists<T extends SkillGrantSource>(skills: readonly T[]): T[];
+/** Does this skill declare a list (either, non-empty)? The one test of "the Skill card is asked for this skill". */
+export declare function declaresSkillLists(skill: Pick<SkillGrantSource, "allowedTools" | "disallowedTools">): boolean;
+/**
+ * Compile one skill's two lists into rows (`origin` stamped on each) and the entries that read as nothing. An allow list
+ * holding `*` voids that list whole (every other entry on it is reported too: the list grants nothing — the safe direction).
+ * A `*` on the deny list reads as nothing by itself and the rest of that list still refuses: a deny list never loses an
+ * entry to a wildcard beside it.
+ */
+export declare function compileSkillGrant(skill: SkillGrantSource, origin: SkillGrantOrigin): {
+    rows: SkillGrantRow[];
+    inert: SkillInertEntry[];
+};
+/** The call facts a content row is judged against — the persisted lane's own bases. */
+export interface SkillGrantJudgeContext {
+    readonly root: string | undefined;
+    readonly sessionId: string | undefined;
+    readonly liveCwd: () => string | undefined;
+    readonly home: string | undefined;
+}
+/** What spoke for a call: the skill and the entries it stands on. */
+export interface SkillGrantHit {
+    readonly skill: string;
+    readonly entries: readonly string[];
+}
+/** The refusal a deny row writes. */
+export declare function skillDenyDecision(hit: SkillGrantHit): PermissionResult;
+/** The run's deny rows over `req` through `lane` — the refusal they write, or undefined (no lane, no row). The one
+ *  reading the gate's regular decision, its approved-edit round and the resumed execution boundary share. */
+export declare function skillRowRefusal(lane: Pick<SkillGrantLane, "denying"> | undefined, req: ToolCallRequest): PermissionResult | undefined;
+/** The allow a grant writes (the allow layer's skill member). */
+export declare function skillAllowDecision(hit: SkillGrantHit, updatedInput: unknown): PermissionResult;
+/**
+ * The Skill card's question: the reference implementation's sentence (`Execute skill: <name>`), and — when approving
+ * releases anything — the entries it releases for the rest of the run in this mode (an entry that grants nothing, or
+ * stands down in this mode, is not named). Deployment text, sanitized and capped.
+ */
+export declare function skillActivationQuestion(skill: SkillGrantSource, mode: PermissionMode | undefined): string;
+/** The face the gate and the resumed execution boundary read the table through, bound to the leg's call facts. */
+export interface SkillGrantLane {
+    /** The allow layer's skill member: what grants this call in this mode, or undefined. */
+    allowing(req: ToolCallRequest, mode: PermissionMode | undefined): SkillGrantHit | undefined;
+    /** The run's deny rows: what refuses this call, or undefined. */
+    denying(req: ToolCallRequest): SkillGrantHit | undefined;
+}
+/** The gate inputs the run's skill rows ride (a member group of `ToolGateInput`). */
+export interface SkillGateSeats {
+    /**
+     * The active skills' rows for this run. DENY rows (a skill's `disallowed-tools`) are read where a person's deny rows are
+     * read — on every decision right after them, and on an approved edit's bytes — and refuse with `decisionReason: "skill"`
+     * (`deniedBy: "policy"`). ALLOW rows are the allow layer's member beside a person's stored allow rows, under the same
+     * consumption predicate: they clear only an ask an allow rule may clear (never a mandated one, a hook's, an ask rule's,
+     * governance's or a marked call's) and are not re-read on an approved edit. `onAllowed` observes a call they cleared (the
+     * allow-side attribution; never affects the outcome). Absent ⇒ no skill rows.
+     */
+    skillGrants?: SkillGrantLane & {
+        onAllowed?: (info: {
+            toolName: string;
+            toolCallId: string;
+            skill: string;
+            entries: readonly string[];
+        }) => void;
+    };
+}
+/** The `Skill` tool's per-call seat over the loaded skills: a skill that declares a list states no permission of its own. */
+export type SkillSeatReader = (args: unknown, mode: PermissionMode | undefined) => PermissionSeatReading | undefined;
+/** The reader over these skills (`undefined` when none is loaded): `Execute skill: <name>` for a skill declaring a list. */
+export declare function skillSeatReader(skills: readonly SkillGrantSource[]): SkillSeatReader | undefined;
+/**
+ * The gate's seat inputs for one call, composed in ONE place: the mounted instance's static seat (`calledName`), the `Skill`
+ * tool's per-call reader in the leg's live mode (only when the call's wire name is the engine's `Skill` — `skillToolName`),
+ * and the run's skill rows with their attribution sink.
+ */
+export declare function skillGateWiring(opts: {
+    tools: readonly AgentTool[];
+    skillToolName: string;
+    seatOf: SkillSeatReader | undefined;
+    mode: () => PermissionMode | undefined;
+    lane: SkillGrantLane;
+    onAllowed: NonNullable<SkillGateSeats["skillGrants"]>["onAllowed"];
+}): (calledName: string, wireName: string) => PermissionSeatInputs & SkillGateSeats;
+/**
+ * Seed a task's table at prepare, before any call is gated: the rows from outside this leg's own writers (`inherited` — a
+ * parent's capture, held until this child ends, and a resumed leg's frozen rows, which keep the word `model` where the
+ * model wrote them) and the skills the person invoked by name (`user` — the invocation is the statement, so no card). Every invoked
+ * name must be one of the loaded skills; anything else (or a value that is not a list of names) refuses the run loudly
+ * (`config.user_invoked_skill_unknown`), never dropped. Returns the entries the grammar reads as nothing, across every
+ * loaded skill — the start-of-run notice's content.
+ */
+export declare function seedSkillGrants(table: SkillGrantTable, opts: {
+    skills: readonly SkillGrantSource[];
+    userInvokedSkills: unknown;
+    inherited: readonly SkillGrantRecord[] | undefined;
+}): readonly SkillInertEntry[];
+/** The per-task table. Identity is the contract: the `Skill` tool, prepare's seeds, the tool ctx's snapshot and the
+ *  lane all hold this one object. */
+export declare class SkillGrantTable {
+    private rowsHeld;
+    /** The table never holds the same row twice (skill, origin, list, entry) — one rule for both writers: a re-activation, a
+     *  capture re-supplied beside the frozen rows that already carry it. Keyed on the ROW, not the skill: a definition that
+     *  changed across a park writes its new rows when it is activated again. */
+    private hold;
+    /** Write a skill's rows (rows already held are not held twice). Returns the entries that read as nothing. */
+    activate(skill: SkillGrantSource, origin: SkillGrantOrigin): readonly SkillInertEntry[];
+    /** Seed portable records (a delegated child's capture, a resumed leg's frozen rows): a record the model wrote keeps that
+     *  word, every other record seeds under `origin` — `user` is written only from this leg's own spec, never seeded. */
+    seed(records: readonly SkillGrantRecord[], origin: SkillGrantOrigin): void;
+    /** The rows as portable records (a copy). */
+    records(): readonly SkillGrantRecord[];
+    /** The lane over this table, bound to the leg's call facts. */
+    lane(ctx: SkillGrantJudgeContext): SkillGrantLane;
+}
+/** Read a delegated child's capture ({@link readCarriedRecords}): `undefined` refuses the delegation. */
+export declare function readSkillGrantCapture(snapshot: readonly unknown[] | undefined): readonly SkillGrantRecord[] | undefined;
+/** The section a park freezes (`CheckpointState.skillGrants`): the table's rows under the frozen origins, or undefined
+ *  when there are none (an absent section IS zero rows on every reader). */
+export declare function frozenSkillGrants(table: Pick<SkillGrantTable, "records">): SkillGrantRecord[] | undefined;
+/** Read a park's frozen section ({@link readCarriedRecords}): absent ⇒ none; `undefined` ⇒ damaged — the resume refuses
+ *  it before the claim and prepare never seeds from it. */
+export declare function readFrozenSkillGrants(section: unknown): readonly SkillGrantRecord[] | undefined;
+/** The start-of-run notice for entries that grant (or refuse) nothing. */
+export declare const SKILL_ENTRY_NOT_GRANTED_CODE = "skills.allowed_tool_not_granted";
+/** The refusal for a `TaskSpec.userInvokedSkills` name the run does not carry (or a value that is not a list of names). */
+export declare const USER_INVOKED_SKILL_UNKNOWN_CODE = "config.user_invoked_skill_unknown";
+/**
+ * The notice for entries this grammar reads as nothing — one per prepared task, delivered only when one exists. The
+ * deployment's operator owns the skill files; the run goes on (an entry that grants nothing makes it ask more).
+ */
+export declare function skillEntriesNotGrantedNotice(inert: readonly SkillInertEntry[], sessionId: string): EngineNotice;
+export {};

package/dist/core/skill-grant.js

@@ -0,0 +1,313 @@
+import { heldBy, wireOf } from "./tool-name-readings.js";
+import { isNamespacedCoveringRuleName, namespacedRuleNameCovers, parsePermissionRule } from "./permission-rules.js";
+import { protocolOf } from "./protocol-table.js";
+import { COARSE_SHELL_TOOLS } from "./tool-policy.js";
+import { COMMAND_RULE_TOOL, READ_RULE_TOOL, findAdmittingRule, laneToolNamesOf, parseRuleText, programRunReachOf, ruleToolGrammarOf } from "./permission-rule-model.js";
+import { pathRuleLaneAnswer } from "./runner/permission-rule-lanes.js";
+import { mountedToolPermissionSeat } from "./mode-policy.js";
+import { inlineUntrusted } from "./untrusted-text.js";
+import { boundInputHashOf } from "./canonical-json.js";
+export const SKILL_GRANT_ORIGINS = Object.freeze(["model", "user", "inherited"]);
+const FROZEN_SKILL_GRANT_ORIGINS = new Set(["model", "inherited"]);
+export const SKILL_ENTRY_INERT_REASONS = Object.freeze(["wildcard_all", "namespace_wildcard", "path_pattern", "domain", "content_unsupported", "grammar"]);
+export function skillNamedBy(args, skills) {
+    const named = args?.skill;
+    return typeof named === "string" ? skills.find((s) => s.name === named) : undefined;
+}
+export function skillGrantDigest(skill) {
+    const canonical = (entries) => [...new Set((entries ?? []).map((e) => {
+            const p = parsePermissionRule(e);
+            return p.ruleContent === undefined ? p.toolName : `${p.toolName}(${p.ruleContent})`;
+        }))].sort();
+    return boundInputHashOf({ skill: skill?.name ?? null, allowedTools: canonical(skill?.allowedTools), disallowedTools: canonical(skill?.disallowedTools) });
+}
+export function skillCallGrantDigest(call, args, skills, skillToolName) {
+    return skills.length > 0 && wireOf("skillGrant.binding", call) === skillToolName ? skillGrantDigest(skillNamedBy(args, skills)) : undefined;
+}
+export function parkedSkillApprovalRefusal(row, args, skills, skillToolName, site = "claim") {
+    if (row.boundGrantDigest === undefined && skillCallGrantDigest(row, args, skills, skillToolName) === undefined)
+        return undefined;
+    if (skillGrantDigest(skillNamedBy(args, skills)) === row.boundGrantDigest)
+        return undefined;
+    const nameIn = (a) => a?.skill;
+    const shown = (n) => inlineUntrusted(typeof n === "string" ? n : String(n), 120);
+    const chosen = shown(nameIn(args));
+    const why = row.boundGrantDigest === undefined
+        ? `this parked Skill activation of "${chosen}" carries no digest of the allowed-tools / disallowed-tools it was asked under (it was parked before Skill approvals bound them), so it cannot cover what the activation grants or refuses`
+        : nameIn(args) !== nameIn(row.args)
+            ? `this Skill approval was given on the card for "${shown(nameIn(row.args))}", and ${site === "claim" ? "this decision selects" : "the call would now activate"} "${chosen}" — not the Skill that card asked about, so the approval does not cover activating it`
+            : `"${chosen}" no longer declares the allowed-tools / disallowed-tools this Skill approval was asked under — as this resume serves it (one it does not load counts as absent), it changed after the approval was given, so the approval does not cover what activating it would now grant or refuse`;
+    return site === "claim"
+        ? `${why} — refusing pre-CAS (nothing ran; the checkpoint stays pending). Decide this checkpoint as deny and re-activate it: the new card shows the current lists.`
+        : `The approved Skill call was not executed: ${why}. This approval is spent — to use "${chosen}", have the model activate it again: the new card shows its lists.`;
+}
+export function detachSkillLists(skills) {
+    return skills.map((s) => (typeof s === "object" && s !== null ? { ...s, ...(Array.isArray(s.allowedTools) ? { allowedTools: [...s.allowedTools] } : {}), ...(Array.isArray(s.disallowedTools) ? { disallowedTools: [...s.disallowedTools] } : {}) } : s));
+}
+export function declaresSkillLists(skill) {
+    return (skill.allowedTools?.length ?? 0) > 0 || (skill.disallowedTools?.length ?? 0) > 0;
+}
+function ruleRowOf(parsed) {
+    return { ...parsed, scope: { kind: "global" }, adds: [{ dot: { actor: "skill", counter: 1 }, origin: "user", createdAt: "" }] };
+}
+function compileEntry(raw, behavior) {
+    const parsed = parsePermissionRule(raw);
+    const name = parsed.toolName;
+    if (name === "*")
+        return "wildcard_all";
+    if (parsed.ruleContent === undefined) {
+        const ns = protocolOf(name);
+        if (ns !== undefined) {
+            if (name.slice(ns.prefix.length).split("__")[0]?.includes("*") === true)
+                return "namespace_wildcard";
+            if (isNamespacedCoveringRuleName(name))
+                return { kind: "namespace", pattern: name };
+            return { kind: "tool", name };
+        }
+        return COARSE_SHELL_TOOLS.includes(name) ? { kind: "shell", name } : { kind: "tool", name };
+    }
+    if (name === COMMAND_RULE_TOOL) {
+        const allowRead = parseRuleText(raw, behavior);
+        if ("rule" in allowRead)
+            return { kind: "command", rule: ruleRowOf(allowRead.rule), interpreter: false };
+        if (behavior === "allow" && allowRead.reject.code === "invalid.bare_interpreter_prefix") {
+            const wide = parseRuleText(raw, "deny");
+            if ("rule" in wide)
+                return { kind: "command", rule: ruleRowOf({ ...wide.rule, behavior: "allow" }), interpreter: true };
+        }
+        return "grammar";
+    }
+    if (ruleToolGrammarOf(name) === "path") {
+        const read = parseRuleText(raw, behavior);
+        if ("rule" in read) {
+            if (read.rule.match === "subpath" && read.rule.tool === READ_RULE_TOOL && behavior === "allow")
+                return { kind: "read_dir", rule: ruleRowOf(read.rule) };
+            if (behavior === "deny")
+                return { kind: "path", rule: ruleRowOf(read.rule) };
+        }
+        return "path_pattern";
+    }
+    if (/^domain:/.test(parsed.ruleContent))
+        return "domain";
+    return "content_unsupported";
+}
+export function compileSkillGrant(skill, origin) {
+    const rows = [];
+    const inert = [];
+    for (const [list, behavior, entries] of [
+        ["allowed-tools", "allow", skill.allowedTools ?? []],
+        ["disallowed-tools", "deny", skill.disallowedTools ?? []],
+    ]) {
+        const voided = behavior === "allow" && entries.some((e) => parsePermissionRule(e).toolName === "*");
+        for (const entry of entries) {
+            const compiled = voided ? "wildcard_all" : compileEntry(entry, behavior);
+            if (typeof compiled === "string")
+                inert.push({ skill: skill.name, list, entry, reason: compiled });
+            else
+                rows.push({ skill: skill.name, origin, behavior, entry, compiled });
+        }
+    }
+    return { rows, inert };
+}
+function standsDownIn(row, mode, req) {
+    if (mode !== "auto")
+        return false;
+    if (row.compiled.kind === "shell" || (row.compiled.kind === "command" && row.compiled.interpreter))
+        return true;
+    return row.compiled.kind === "tool" && req !== undefined && answersTo(req, (n) => COARSE_SHELL_TOOLS.includes(n));
+}
+function answersTo(req, has) {
+    return heldBy("skillGrant.names", { has }, req);
+}
+function nameRowReaches(compiled, req) {
+    const covers = compiled.kind === "namespace" ? (n) => namespacedRuleNameCovers(compiled.pattern, n) : compiled.kind === "tool" || compiled.kind === "shell" ? (n) => n === compiled.name : undefined;
+    return covers !== undefined && answersTo(req, covers);
+}
+function commandOf(req) {
+    const tool = laneToolNamesOf(req).find((n) => ruleToolGrammarOf(n) === "command");
+    const command = req.args?.command;
+    return tool !== undefined && typeof command === "string" ? { tool, command } : undefined;
+}
+function judge(rows, req, behavior, ctx) {
+    const live = rows.filter((r) => r.behavior === behavior);
+    if (live.length === 0)
+        return undefined;
+    for (const row of live)
+        if (nameRowReaches(row.compiled, req))
+            return { skill: row.skill, entries: [row.entry] };
+    const call = commandOf(req);
+    const liveCwd = ctx.liveCwd();
+    if (call !== undefined) {
+        const byRule = new Map();
+        for (const r of live)
+            if (r.compiled.kind === "command")
+                byRule.set(r.compiled.rule, r);
+        if (behavior === "allow") {
+            const covering = findAdmittingRule([...byRule.keys()], { tool: call.tool, command: call.command, cwd: ctx.root, ...(ctx.sessionId !== undefined ? { sessionId: ctx.sessionId } : {}), ...(liveCwd !== undefined ? { execCwd: liveCwd } : {}) });
+            const hits = (covering ?? []).flatMap((rule) => byRule.get(rule) ?? []);
+            const first = hits[0];
+            if (first !== undefined)
+                return { skill: first.skill, entries: hits.map((r) => r.entry) };
+        }
+        else {
+            for (const [rule, row] of byRule) {
+                if (programRunReachOf(rule, call.command).reach !== "not_reached")
+                    return { skill: row.skill, entries: [row.entry] };
+            }
+        }
+    }
+    const pathKind = behavior === "allow" ? "read_dir" : "path";
+    const pathRows = live.filter((r) => r.compiled.kind === pathKind);
+    if (pathRows.length > 0) {
+        const table = pathRows.map((r) => r.compiled.rule);
+        for (const name of laneToolNamesOf(req).filter((n) => ruleToolGrammarOf(n) === "path")) {
+            const answer = pathRuleLaneAnswer(table, { ...req, toolName: name }, { root: ctx.root, sessionId: ctx.sessionId, liveCwd, home: ctx.home });
+            const spoke = answer !== undefined && ("unreadable" in answer ? behavior === "deny" : "behavior" in answer && answer.behavior === behavior);
+            if (spoke) {
+                const rule = answer !== undefined && "rules" in answer ? answer.rules[0]?.rule : undefined;
+                const row = pathRows.find((r) => r.compiled.rule.rule === rule) ?? pathRows[0];
+                return { skill: row.skill, entries: [row.entry] };
+            }
+        }
+    }
+    return undefined;
+}
+export function skillDenyDecision(hit) {
+    return {
+        action: "deny",
+        message: `the active skill "${inlineUntrusted(hit.skill, 120)}" lists this tool in disallowed-tools (${hit.entries.map((e) => inlineUntrusted(e, 200)).join(", ")}) — refused for the rest of this run`,
+        decisionReason: "skill",
+    };
+}
+export function skillRowRefusal(lane, req) {
+    const hit = lane?.denying(req);
+    return hit === undefined ? undefined : skillDenyDecision(hit);
+}
+export function skillAllowDecision(hit, updatedInput) {
+    return {
+        action: "allow",
+        message: `the active skill "${inlineUntrusted(hit.skill, 120)}" lists this tool in allowed-tools (${hit.entries.map((e) => inlineUntrusted(e, 200)).join(", ")})`,
+        decisionReason: "skill",
+        ...(updatedInput !== undefined ? { updatedInput } : {}),
+    };
+}
+const CARD_ENTRIES_MAX = 10;
+const CARD_ENTRY_MAX_CHARS = 120;
+export function skillActivationQuestion(skill, mode) {
+    const head = `Execute skill: ${inlineUntrusted(skill.name, 200)}`;
+    const granting = compileSkillGrant(skill, "model").rows.filter((r) => r.behavior === "allow" && !standsDownIn(r, mode));
+    if (granting.length === 0)
+        return head;
+    const shown = granting.slice(0, CARD_ENTRIES_MAX).map((r) => inlineUntrusted(r.entry, CARD_ENTRY_MAX_CHARS));
+    const rest = granting.length - shown.length;
+    return `${head}\nApproving also lets these tools be used without asking for the rest of this run: ${shown.join(", ")}${rest > 0 ? ` and ${rest} more` : ""}`;
+}
+export function skillSeatReader(skills) {
+    if (skills.length === 0)
+        return undefined;
+    return (args, mode) => {
+        const skill = skillNamedBy(args, skills);
+        return skill !== undefined && declaresSkillLists(skill) ? { seat: "passthrough", question: skillActivationQuestion(skill, mode) } : undefined;
+    };
+}
+export function skillGateWiring(opts) {
+    const skillGrants = { ...opts.lane, ...(opts.onAllowed !== undefined ? { onAllowed: opts.onAllowed } : {}) };
+    return (calledName, wireName) => ({
+        ...(mountedToolPermissionSeat(opts.tools, calledName) === "passthrough" ? { permissionSeat: "passthrough" } : {}),
+        ...(opts.seatOf !== undefined && wireName === opts.skillToolName ? { permissionSeatOf: (args) => opts.seatOf?.(args, opts.mode()) } : {}),
+        skillGrants,
+    });
+}
+export function seedSkillGrants(table, opts) {
+    table.seed(opts.inherited ?? [], "inherited");
+    const named = (n) => skillNamedBy({ skill: n }, opts.skills);
+    const invoked = opts.userInvokedSkills;
+    if (invoked !== undefined) {
+        const unknown = Array.isArray(invoked) ? invoked.filter((n) => named(n) === undefined) : [invoked];
+        if (unknown.length > 0) {
+            const e = new Error(`TaskSpec.userInvokedSkills names ${unknown.map((n) => JSON.stringify(n)).join(", ")}, which ${unknown.length === 1 ? "is" : "are"} not a skill this run carries (the loaded skills: ${opts.skills.map((s) => s.name).join(", ") || "none"}) — refusing rather than running without the invocation`);
+            e.code = USER_INVOKED_SKILL_UNKNOWN_CODE;
+            throw e;
+        }
+        for (const name of invoked)
+            table.activate(named(name), "user");
+    }
+    return opts.skills.flatMap((s) => compileSkillGrant(s, "model").inert);
+}
+export class SkillGrantTable {
+    rowsHeld = [];
+    hold(row) {
+        if (!this.rowsHeld.some((r) => r.skill === row.skill && r.origin === row.origin && r.behavior === row.behavior && r.entry === row.entry))
+            this.rowsHeld.push(row);
+    }
+    activate(skill, origin) {
+        const { rows, inert } = compileSkillGrant(skill, origin);
+        for (const row of rows)
+            this.hold(row);
+        return inert;
+    }
+    seed(records, origin) {
+        for (const r of records) {
+            const compiled = compileEntry(r.entry, r.behavior);
+            if (typeof compiled === "string")
+                continue;
+            this.hold({ skill: r.skill, origin: r.origin === "model" ? "model" : origin, behavior: r.behavior, entry: r.entry, compiled });
+        }
+    }
+    records() {
+        return this.rowsHeld.map((r) => ({ skill: r.skill, behavior: r.behavior, entry: r.entry, origin: r.origin }));
+    }
+    lane(ctx) {
+        return {
+            allowing: (req, mode) => judge(this.rowsHeld.filter((r) => !standsDownIn(r, mode, req)), req, "allow", ctx),
+            denying: (req) => judge(this.rowsHeld, req, "deny", ctx),
+        };
+    }
+}
+function readCarriedRecords(raw, carrier) {
+    if (raw === undefined)
+        return [];
+    if (!Array.isArray(raw))
+        return undefined;
+    const out = [];
+    for (const r of raw) {
+        if (typeof r !== "object" || r === null)
+            return undefined;
+        const { skill, behavior, entry, origin } = r;
+        if (typeof skill !== "string" || typeof entry !== "string" || (behavior !== "allow" && behavior !== "deny"))
+            return undefined;
+        if (typeof compileEntry(entry, behavior) === "string")
+            return undefined;
+        if (carrier === "capture") {
+            out.push({ skill, behavior, entry });
+            continue;
+        }
+        if (!FROZEN_SKILL_GRANT_ORIGINS.has(origin))
+            return undefined;
+        out.push({ skill, behavior, entry, origin: origin });
+    }
+    return out;
+}
+export function readSkillGrantCapture(snapshot) {
+    return readCarriedRecords(snapshot, "capture");
+}
+export function frozenSkillGrants(table) {
+    const rows = table.records().filter((r) => FROZEN_SKILL_GRANT_ORIGINS.has(r.origin));
+    return rows.length > 0 ? rows : undefined;
+}
+export function readFrozenSkillGrants(section) {
+    return readCarriedRecords(section, "frozen");
+}
+export const SKILL_ENTRY_NOT_GRANTED_CODE = "skills.allowed_tool_not_granted";
+export const USER_INVOKED_SKILL_UNKNOWN_CODE = "config.user_invoked_skill_unknown";
+const NOTICE_ENTRIES_SHOWN = 5;
+export function skillEntriesNotGrantedNotice(inert, sessionId) {
+    const shown = inert.slice(0, NOTICE_ENTRIES_SHOWN).map((e) => `${inlineUntrusted(e.skill, 80)}: ${e.list} "${inlineUntrusted(e.entry, 120)}" (${e.reason})`);
+    const rest = inert.length - shown.length;
+    return {
+        code: SKILL_ENTRY_NOT_GRANTED_CODE,
+        message: `${inert.length} skill list entr${inert.length === 1 ? "y grants" : "ies grant"} or refuse${inert.length === 1 ? "s" : ""} nothing — ${shown.join("; ")}${rest > 0 ? `; and ${rest} more` : ""}. ` +
+            "An allowed-tools list holding `*` voids the list, `mcp__*` names no server, and a write-path or domain entry has no allow reading; name the tools (or `mcp__<server>`) instead.",
+        detail: { sessionId, entries: inert.map((e) => ({ skill: e.skill, list: e.list, entry: e.entry, reason: e.reason })) },
+    };
+}

package/dist/core/skills-directory.d.ts

@@ -18,7 +18,11 @@
  * directory third parties can write to is the same as pasting their text into the system prompt. The
  * loader validates SHAPE (spec conformance), never intent.
  *
- * **`allowed-tools` is mapped TIGHTEN-ONLY** — see {@link SkillsDirectoryOptions.deployedTools}.
+ * **`allowed-tools` / `disallowed-tools` are COPIED, never judged.** Each frontmatter list reaches
+ * {@link SkillSpec.allowedTools} / {@link SkillSpec.disallowedTools} entry by entry as the author wrote it — no
+ * intersection with a roster, no projection onto a tool name, no refusal, no de-duplication. What an entry means
+ * (a tool, a namespace, a command rule, a path, a wildcard that grants nothing) is read in ONE place, the run's
+ * grant table, which announces what it cannot read; a loader that also judged would be a second reader of the grammar.
  *
  * Frontmatter is parsed by a deliberately closed subset reader (no YAML dependency — the runtime
  * dependency budget is a standing constraint): top-level `key: value` scalars, optional surrounding
@@ -42,17 +46,8 @@ export type SkillsDirectoryWarningCode =
  | "name_mismatch"
 /** Required `description` absent. */
  | "missing_description"
-/** An `allowed-tools` entry carries a pattern specifier (`Bash(git:*)`) — the scope policy
- *  matches names, not patterns, so the entry cannot match and the tool is DISABLED in this skill
- *  frame. Disclosed loudly until pattern enforcement lands (the entry is deliberately NOT widened to
- *  its base name: that would turn "only git" into "all of Bash"). */
- | "allowed_tool_pattern_unsupported"
 /** `description` exceeds the spec cap. */
  | "description_too_long"
-/** An `allowed-tools` entry the deployment does not mount — dropped (tighten-only). */
- | "allowed_tool_not_mounted"
-/** A `disallowed-tools` declaration this mapping cannot carry — see {@link SkillsDirectoryOptions.deployedTools}. */
- | "disallowed_tools_unenforced"
 /** An attachment was left out (non-text bytes, over budget, unreadable, or resolving outside the skill). */
  | "attachment_skipped"
 /** A file or directory entry existed but could not be read/resolved. */
@@ -66,30 +61,6 @@ export interface SkillsDirectoryWarning {
     detail: string;
 }
 export interface SkillsDirectoryOptions {
-    /**
-     * The tool names this deployment actually mounts. When given, a skill's `allowed-tools` declaration is
-     * INTERSECTED with it and every name outside is dropped with an `allowed_tool_not_mounted` warning.
-     *
-     * 🔴 **Tighten-only, by ruling.** `allowed-tools` is a skill-authored capability claim and the format
-     * marks it experimental; sema's permission discipline is tighten-only, so it is mapped exclusively onto
-     * {@link SkillManifest} — a structure that can only SUBTRACT capability (the scope policy returns
-     * `allow`/`deny` and composes ahead of the task policy under a deny-short-circuit fold, so it can never
-     * re-grant what the task withheld). Consequences worth stating plainly:
-     * - a name outside `deployedTools` is dropped, NOT honored — a skill cannot pull in a tool the
-     *   deployment never mounted;
-     * - when the intersection comes out EMPTY the manifest is still emitted with an empty `allowTools`
-     *   (narrow to nothing while the skill's frame is active). Dropping the manifest instead would widen
-     *   the run relative to what the skill asked for, which is the one direction this mapping may not take;
-     * - omitting `deployedTools` skips the filter. Still safe — an unmounted name simply never matches a
-     *   call — but the warning is then unavailable, so a deployment that wants the audit trail should pass it.
-     *
-     * Names are compared in CANONICAL form on both sides (the same normalization the enforcing policy
-     * applies), so passing this option can never produce a stricter result than omitting it: a declared
-     * legacy alias and the mounted current name are one tool here exactly as they are at call time.
-     * A wildcard declaration (`allowed-tools: "*"`) claims the whole roster and therefore narrows by
-     * nothing — no manifest is emitted, leaving the task policy untouched.
-     */
-    deployedTools?: readonly string[];
     /** Sink for non-fatal diagnostics. Absent ⇒ warnings are dropped and the load still proceeds. */
     onWarning?: (warning: SkillsDirectoryWarning) => void;
     /**