@sema-ai/core 1.275.1

package/dist/core/roles.js

@@ -0,0 +1,272 @@
+import { selectModel } from "./select-model.js";
+/** Resolve a string ModelRef against the catalog (a Model object passes through). */
+export function resolveModel(ref, models) {
+    if (typeof ref !== "string") {
+        return ref;
+    }
+    const m = models?.[ref];
+    if (!m) {
+        throw new Error(`Unknown model ref "${ref}". Provide it in RunnerDeps.models or pass a Model object.`);
+    }
+    return m;
+}
+// --- 模型档位层(model tiers,clay 拍 2026-07-11)-----------------------------------------------------------
+// sema 自己的能力档位命名(简洁、业界心智):pro/flash 承 DeepSeek 既有习惯,向上 max(前沿旗舰)、向下
+// lite(最便宜);ultra 预留在 max 之上(降档链已排位,center 绑定模型即生效,零码改扩档)。
+// CC alias 兼容:CC-trained 模型/用户会说 opus/sonnet/haiku/fable —— 内置固定映射到 sema 档位
+// (兼容语义不随部署漂,故不可配)。档位→具体模型的绑定(RunnerDeps.tiers)是部署/center 配置。
+// ⚠️ 与 select-model.ts 的 `ModelTier`("cheap|standard|premium",model.params.tier 上的选型过滤属性)
+// 是不同层:那是 selectModel criteria 的机器过滤维度,这里是人/模型可寻址的命名档位——不合并。
+/** 档位降档链(强→弱)。解析某档无绑定时沿链向后找第一个有绑定的档(fail-open 可用性优先;绑定缺口
+ *  在部署 catalog 审计面可见)。`ultra` 预留:排在 `max` 前,今天不绑,未来加档零码改。 */
+export const DEFAULT_TIER_ORDER = ["ultra", "max", "pro", "flash", "lite"];
+/** CC 档位词 → sema 档位(内置固定,兼容层):fable/mythos→max · opus→pro · sonnet→flash · haiku→lite。 */
+export const CC_MODEL_TIER_ALIASES = {
+    fable: "max",
+    mythos: "max",
+    opus: "pro",
+    sonnet: "flash",
+    haiku: "lite",
+};
+/**
+ * Expand a deployment's tier bindings into the model catalog: every tier name (and every CC alias whose
+ * tier resolves) becomes a catalog key pointing at the bound Model, so the ENTIRE resolve surface
+ * (`resolveModel` / roles / `@model` mentions / Agent tool `model` / workflow `agent() opts.model`)
+ * accepts tier vocabulary with ZERO per-callsite changes. Called ONCE at Runner construction.
+ *
+ * Rules:
+ * - a tier with no binding falls back DOWN {@link DEFAULT_TIER_ORDER} to the first bound tier
+ *   (e.g. `max` unbound + `pro` bound ⇒ "max" resolves to the pro model — availability over strictness;
+ *   the gap stays visible in the deployment's catalog audit, not silently absent);
+ * - an existing catalog key of the same name WINS (deployment SHADOW semantics, mirroring agents):
+ *   a deployment that already ships a model literally named "pro" keeps it untouched;
+ * - a binding may itself be a catalog name or a Model object (resolved through `resolveModel`);
+ *   an unknown binding name throws at construction (config error surfaces at boot, not first use).
+ */
+/** Symbol key stamped onto a tier-expanded catalog so role→tier defaults know tiers are ACTIVE.
+ *  A deployment whose plain catalog happens to carry a key literally named `pro`/`flash` must NOT be
+ *  pulled into tier routing (the INERT promise holds by configuration, not by key-name luck). A symbol
+ *  survives object spread yet stays invisible to Object.keys/JSON/`@model` allowlists. */
+const TIERS_ACTIVE = Symbol.for("sema.tiersActive");
+export function expandTiers(models, tiers) {
+    if (!tiers || Object.keys(tiers).length === 0)
+        return models;
+    const out = { ...models };
+    out[TIERS_ACTIVE] = true;
+    const bound = (name) => {
+        const b = tiers[name];
+        return b === undefined ? undefined : resolveModel(b, models);
+    };
+    // A tier name outside the default order (a deployment inventing its own tier) still resolves directly;
+    // only the KNOWN order participates in the fallback walk.
+    const resolveTier = (name) => {
+        const direct = bound(name);
+        if (direct)
+            return direct;
+        const at = DEFAULT_TIER_ORDER.indexOf(name);
+        if (at === -1)
+            return undefined;
+        for (let i = at + 1; i < DEFAULT_TIER_ORDER.length; i++) {
+            const next = bound(DEFAULT_TIER_ORDER[i]);
+            if (next)
+                return next;
+        }
+        return undefined;
+    };
+    const tierNames = new Set([...DEFAULT_TIER_ORDER, ...Object.keys(tiers)]);
+    for (const name of tierNames) {
+        if (out[name])
+            continue; // deployment catalog key SHADOWs the tier expansion
+        const m = resolveTier(name);
+        if (m)
+            out[name] = m;
+    }
+    for (const [alias, tier] of Object.entries(CC_MODEL_TIER_ALIASES)) {
+        if (out[alias])
+            continue; // same SHADOW rule for alias keys
+        const m = resolveTier(tier);
+        if (m)
+            out[alias] = m;
+    }
+    return out;
+}
+/**
+ * Parse a leading/inline `@model` mention out of a user message, restoring the chat "@-model" UX.
+ * Returns the matched model **name** (a catalog ref the caller resolves), never a Model object — and
+ * **only ever a name from `allowedNames`**. This is the security boundary: untrusted end-user text can
+ * pick *which configured model* to use, but can never inject an arbitrary `baseUrl`/`apiKey`/Model
+ * (see design/11). Matches the first allow-listed mention; the rest of the text is returned cleaned.
+ *
+ * Typical use: `const { model, cleanedText } = parseModelMention(userMsg, Object.keys(deps.models));`
+ * then `runTask({ objective: cleanedText, model })` (omit `model` to fall back to the default role).
+ */
+export function parseModelMention(text, allowedNames) {
+    const allowed = new Map();
+    for (const n of allowedNames)
+        allowed.set(n.toLowerCase(), n);
+    const re = /(^|\s)@([A-Za-z0-9._/-]+)/g;
+    let m;
+    while ((m = re.exec(text)) !== null) {
+        const raw = m[2];
+        const trimmed = raw.replace(/[.,!?:;]+$/, ""); // drop trailing sentence punctuation
+        const canon = allowed.get(trimmed.toLowerCase());
+        if (canon) {
+            const at = m.index + m[1].length; // position of '@'
+            const end = at + 1 + trimmed.length; // end of the matched name (excl. trailing punctuation)
+            const cleaned = (text.slice(0, at) + text.slice(end)).replace(/[ \t]{2,}/g, " ").trim();
+            return { model: canon, cleanedText: cleaned };
+        }
+    }
+    return { cleanedText: text.trim() };
+}
+/**
+ * Role → 档位默认表(clay 拍 2026-07-11:「role 体系用户不感知」)。配了 `RunnerDeps.tiers` 的部署,
+ * 各 role 未显式配置时自动落到语义档位——用户/壳只感知档位,roles 降级为内部路由层:
+ * - `default` → `pro`(主力档兜底;用户/部署 roles.default / TaskSpec.model 恒可覆盖);
+ * - `summarize` → `flash`(压缩本该便宜;flash 未绑沿降档链到 lite);
+ * - `advisor` → 第一档(`ultra` 起,未绑降档到 max/pro——teacher 用最强的);
+ * - `verifier` → `pro`;
+ * - `subagent`/`team`/`synthesize` 无档位默认 = 走 FALLBACK 继承主模型(LLM 可经 model 参数自选档)。
+ * 未配 tiers 的部署:catalog 无 TIERS_ACTIVE 标记 → 表整体 INERT,行为与从前逐字节一致
+ * (即使 catalog 恰有裸模型名 `pro`/`flash` 也不入档位路由——INERT 靠配置成立,不靠键名运气)。
+ */
+export const ROLE_TIER_DEFAULTS = {
+    default: "pro",
+    summarize: "flash",
+    advisor: DEFAULT_TIER_ORDER[0], // "ultra" — 第一档起,降档链兜底
+    verifier: "pro",
+};
+/** The role's tier-default model — ONLY when the catalog was actually tier-expanded ({@link TIERS_ACTIVE}).
+ *  Without the stamp the table is INERT even if the catalog carries a key coincidentally named like a tier. */
+function roleTierModel(role, models) {
+    if (!models || !models[TIERS_ACTIVE])
+        return undefined;
+    const tier = ROLE_TIER_DEFAULTS[role];
+    return tier !== undefined ? models[tier] : undefined;
+}
+/** Each role falls back along this chain when it has no model of its own. */
+const FALLBACK = {
+    default: [],
+    summarize: ["default"],
+    subagent: ["default"],
+    team: ["default"],
+    synthesize: ["team", "default"],
+    advisor: ["default"], // unset → the "teacher" falls back to the student model (degrades gracefully)
+    verifier: ["default"], // unset → the verification gate's verifier falls back to the main model
+};
+/** Split a RoleSpec (a bare ModelRef OR `{ model, select, thinking, systemPrompt }`) into its parts. */
+function specParts(s) {
+    if (s == null) {
+        return {};
+    }
+    if (typeof s === "string") {
+        return { model: s };
+    }
+    // A Model object (has `id`+`api`) is itself the model; otherwise it's a config object.
+    if ("id" in s && "api" in s) {
+        return { model: s };
+    }
+    const cfg = s;
+    return { model: cfg.model, select: cfg.select, thinking: cfg.thinking, systemPrompt: cfg.systemPrompt };
+}
+/** Normalize a RoleSpec to its `{ model, select, thinking, systemPrompt }` parts (a string/Model becomes `{ model }`). */
+function toConfig(s) {
+    if (s == null) {
+        return undefined;
+    }
+    if (typeof s === "string" || ("id" in s && "api" in s)) {
+        return { model: s };
+    }
+    return s;
+}
+/**
+ * Merge one role's spec from the runner default (`base`) with a task/scenario override (`over`),
+ * **field-aware** so a partial override doesn't silently wipe the model (review finding):
+ * `{ thinking }` keeps the base model and just changes thinking; but a `model` OR `select` in the
+ * override replaces both (they're alternative sources, so a `select` override beats a fixed base model).
+ */
+function mergeRoleSpec(base, over) {
+    const b = toConfig(base);
+    const o = toConfig(over);
+    if (!o)
+        return base;
+    if (!b)
+        return over;
+    const overHasSource = o.model !== undefined || o.select !== undefined;
+    return {
+        model: overHasSource ? o.model : b.model,
+        select: overHasSource ? o.select : b.select,
+        thinking: o.thinking ?? b.thinking,
+        // systemPrompt is independent of the model source (it's the role's prompt preset): override wins.
+        systemPrompt: o.systemPrompt ?? b.systemPrompt,
+    };
+}
+/** Merge two role maps, field-aware per role (task `over` wins). */
+function mergeRoles(base, over) {
+    const out = { ...base };
+    for (const role of Object.keys(over ?? {})) {
+        out[role] = mergeRoleSpec(base?.[role], over?.[role]);
+    }
+    return out;
+}
+/** Resolve a parts → Model: an explicit model wins, else a capability/price `select`. */
+function partsModel(parts, models) {
+    if (parts.model) {
+        return resolveModel(parts.model, models);
+    }
+    if (parts.select) {
+        return selectModel(models ?? {}, parts.select);
+    }
+    return undefined;
+}
+/**
+ * Resolve the model (and default thinking) for a task. Explicit `spec.model` wins; otherwise walk the
+ * `modelRole`'s fallback chain over the merged roles (task overrides runner) and use the first role
+ * that supplies a model. Throws a helpful error if nothing resolves.
+ */
+export function resolveTaskModel(spec, deps) {
+    if (spec.model) {
+        // An explicit model must NOT drop the resolved role's systemPrompt preset — the preset is conditioned on
+        // TaskSpec.systemPrompt (applied later in prepare-task as `spec.systemPrompt ?? resolvedRole.systemPrompt`),
+        // not on whether the model was named explicitly (P-16: a `default` role carrying CODE_AGENT_PROMPT used to
+        // be silently lost for any explicit-model task).
+        const start = spec.modelRole ?? "default";
+        // Read the start role's parts ONCE: an explicit model must drop neither the systemPrompt preset NOR the
+        // role's default `thinking` (codex [R145]: ResolvedRole.thinking is "explicit wins, else the role default" —
+        // the fallback branch below honors that via `spec.thinking ?? parts.thinking`; this branch must match, else
+        // an explicit-model task with a role-default thinking level silently loses it).
+        const startParts = specParts(mergeRoles(deps.roles, spec.roles)[start]);
+        return {
+            model: resolveModel(spec.model, deps.models),
+            thinking: spec.thinking ?? startParts.thinking,
+            systemPrompt: startParts.systemPrompt,
+        };
+    }
+    const start = spec.modelRole ?? "default";
+    const merged = mergeRoles(deps.roles, spec.roles);
+    // The prompt preset belongs to the REQUESTED role's identity, so take it from `start` itself —
+    // it must not be lost when the model resolves via a fallback role that has no preset.
+    const startSystemPrompt = specParts(merged[start]).systemPrompt;
+    for (const role of [start, ...FALLBACK[start]]) {
+        const parts = specParts(merged[role]);
+        // 档位默认(clay 2026-07-11):显式配置 > 本 role 的档位默认 > FALLBACK 链下一站。语义本位——
+        // summarize 未配时先落 flash 档(比继承 default 便宜),而非沿链吃主模型;无 tiers 时 INERT。
+        const model = partsModel(parts, deps.models) ?? roleTierModel(role, deps.models);
+        if (model) {
+            return { model, thinking: spec.thinking ?? parts.thinking, systemPrompt: startSystemPrompt };
+        }
+    }
+    throw new Error(`No model for role "${start}": set TaskSpec.model, or configure RunnerDeps.roles / TaskSpec.roles["${start}"] (or a "default" role). A "select" RoleSpec also fails here if no catalog model matches.`);
+}
+/**
+ * Resolve a role's model **only if that exact role key is configured** (no fallback chain). Used for
+ * the `summarize` compaction model: override only when a summarize-specific model is set, otherwise
+ * let the caller fall back to the main model (unchanged behavior).
+ */
+export function roleModelIfSet(role, spec, deps) {
+    const merged = mergeRoles(deps.roles, spec.roles);
+    // 档位默认同样适用(clay 2026-07-11):tiers 部署下未显式配 summarize 也切 flash 档做压缩;
+    // 无 tiers 时返回 undefined = 调用方沿用主模型(行为不变)。
+    return partsModel(specParts(merged[role]), deps.models) ?? roleTierModel(role, deps.models);
+}
+//# sourceMappingURL=roles.js.map

package/dist/core/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/core/roles.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAsB,MAAM,mBAAmB,CAAC;AAKpE,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,GAAa,EAAE,MAA8B;IACxE,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CACb,sBAAsB,GAAG,4DAA4D,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,sGAAsG;AACtG,oEAAoE;AACpE,2DAA2D;AAC3D,4EAA4E;AAC5E,8DAA8D;AAC9D,0FAA0F;AAC1F,6DAA6D;AAE7D;6DAC6D;AAC7D,MAAM,CAAC,MAAM,kBAAkB,GAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAE9F,0FAA0F;AAC1F,MAAM,CAAC,MAAM,qBAAqB,GAAqC;IACrE,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,KAAK;IACX,MAAM,EAAE,OAAO;IACf,KAAK,EAAE,MAAM;CACd,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH;;;0FAG0F;AAC1F,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAEpD,MAAM,UAAU,WAAW,CACzB,MAAyC,EACzC,KAA2C;IAE3C,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAC7D,MAAM,GAAG,GAA0B,EAAE,GAAG,MAAM,EAAE,CAAC;IAChD,GAAoC,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC;IAC3D,MAAM,KAAK,GAAG,CAAC,IAAY,EAAqB,EAAE;QAChD,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC,CAAC;IACF,uGAAuG;IACvG,0DAA0D;IAC1D,MAAM,WAAW,GAAG,CAAC,IAAY,EAAqB,EAAE;QACtD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QAChC,KAAK,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,kBAAkB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAE,CAAC,CAAC;YAC3C,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;QACxB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,kBAAkB,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,oDAAoD;QAC7E,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAClE,IAAI,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS,CAAC,kCAAkC;QAC5D,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC;YAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AASD;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,YAA8B;IAC5E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,YAAY;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9D,MAAM,EAAE,GAAG,4BAA4B,CAAC;IACxC,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,qCAAqC;QACpF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QACjD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,kBAAkB;YACpD,MAAM,GAAG,GAAG,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,uDAAuD;YAC5F,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACxF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;QAChD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAiD;IAC9E,OAAO,EAAE,KAAK;IACd,SAAS,EAAE,OAAO;IAClB,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAE,EAAE,uBAAuB;IACxD,QAAQ,EAAE,KAAK;CAChB,CAAC;AAEF;+GAC+G;AAC/G,SAAS,aAAa,CAAC,IAAe,EAAE,MAA8B;IACpE,IAAI,CAAC,MAAM,IAAI,CAAE,MAAuC,CAAC,YAAY,CAAC;QAAE,OAAO,SAAS,CAAC;IACzF,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,6EAA6E;AAC7E,MAAM,QAAQ,GAAmC;IAC/C,OAAO,EAAE,EAAE;IACX,SAAS,EAAE,CAAC,SAAS,CAAC;IACtB,QAAQ,EAAE,CAAC,SAAS,CAAC;IACrB,IAAI,EAAE,CAAC,SAAS,CAAC;IACjB,UAAU,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;IAC/B,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,8EAA8E;IACpG,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,wEAAwE;CAChG,CAAC;AAIF,wGAAwG;AACxG,SAAS,SAAS,CAAC,CAAuB;IACxC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QACd,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACtB,CAAC;IACD,uFAAuF;IACvF,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACtB,CAAC;IACD,MAAM,GAAG,GAAG,CAAc,CAAC;IAC3B,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC;AAC1G,CAAC;AAED,0HAA0H;AAC1H,SAAS,QAAQ,CAAC,CAAuB;IACvC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,KAAK,EAAE,CAAa,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,CAAc,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,IAA0B,EAAE,IAA0B;IAC3E,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;IACtE,OAAO;QACL,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;QACxC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;QAC3C,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ;QAClC,kGAAkG;QAClG,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY;KAC/C,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,SAAS,UAAU,CAAC,IAA4B,EAAE,IAA4B;IAC5E,MAAM,GAAG,GAAe,EAAE,GAAG,IAAI,EAAE,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAgB,EAAE,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yFAAyF;AACzF,SAAS,UAAU,CACjB,KAAmD,EACnD,MAA8B;IAE9B,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,WAAW,CAAC,MAAM,IAAI,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAA+F,EAC/F,IAA4D;IAE5D,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,yGAAyG;QACzG,6GAA6G;QAC7G,2GAA2G;QAC3G,iDAAiD;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;QAC1C,wGAAwG;QACxG,6GAA6G;QAC7G,4GAA4G;QAC5G,gFAAgF;QAChF,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACxE,OAAO;YACL,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;YAC5C,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ;YAC9C,YAAY,EAAE,UAAU,CAAC,YAAY;SACtC,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;IAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,+FAA+F;IAC/F,sFAAsF;IACtF,MAAM,iBAAiB,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC;IAChE,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,mEAAmE;QACnE,oEAAoE;QACpE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACjF,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,EAAE,YAAY,EAAE,iBAAiB,EAAE,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,sBAAsB,KAAK,0EAA0E,KAAK,4FAA4F,CACvM,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAe,EACf,IAA4B,EAC5B,IAA4D;IAE5D,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,mEAAmE;IACnE,0CAA0C;IAC1C,OAAO,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;AAC9F,CAAC"}

package/dist/core/runner/active-skill-scope.d.ts

@@ -0,0 +1,64 @@
+import type { ExecutionEnv } from "../../internal/harness.js";
+import type { SkillManifest, ToolEffect } from "../types.js";
+import type { ToolPolicy } from "../tool-policy.js";
+/** One active skill frame: either a resolved manifest, or a fail-closed marker that the manifest for a
+ *  loaded skill could not be resolved (→ DENY-ALL while this frame is active). */
+export type ActiveSkillFrame = {
+    kind: "manifest";
+    manifest: SkillManifest;
+} | {
+    kind: "unresolved";
+    lineageId: string;
+    reason: string;
+};
+/**
+ * The per-task LIFO stack of active skill frames (design/77 §3). Owned by `prepare-task`'s closure;
+ * the injected `skill` tool pushes onto it on a successful load, and a deny-narrowing policy reads it
+ * on every tool call. A simple array is the stack — `push` on load, and the policy reads ALL frames
+ * currently on it (the intersection). v1 keeps lifetime heuristic (see module header).
+ */
+export declare class ActiveSkillScope {
+    private readonly frames;
+    /** Push a resolved manifest frame (skill loaded successfully WITH a manifest). */
+    push(frame: ActiveSkillFrame): void;
+    /** Pop the most-recently-pushed frame (LIFO). Returns it, or undefined when empty. v1 surfaces this
+     *  for the "next-skill-load pops the previous sibling frame" lifetime — see prepare-task wiring. */
+    pop(): ActiveSkillFrame | undefined;
+    /** Snapshot of the live frames (a copy — callers must not mutate the stack through it). */
+    active(): readonly ActiveSkillFrame[];
+    get size(): number;
+}
+/** Path-segment-aware containment, FAMILY-AWARE ([K-PLATFORM-SWEEP] MAJOR#2: canonical keys are
+ *  backslash-form on a win32 env — the "/"-hardcoded suffix rejected every legitimate write there).
+ *  Compare in "/" form with drive-letter case folded; never keyed on process.platform (the env may be
+ *  remote and of the OTHER family than the host). */
+export declare function isWithin(root: string, p: string): boolean;
+/**
+ * Build the Gate-3 deny-narrowing policy over a live {@link ActiveSkillScope} (design/77 §3). For each
+ * tool call, WHILE any skill frame is active:
+ *  - DENY any tool not in the INTERSECTION of every active frame's `allowTools`.
+ *  - For a WRITE tool with an `allowPaths` constraint on ANY active frame, DENY a write whose
+ *    canonicalized target is outside every listed prefix (reuses {@link canonicalizeTarget}, so a
+ *    symlink can't smuggle a write outside the allowed paths).
+ *  - A frame whose manifest could not be resolved (`kind:"unresolved"`) → DENY-ALL (fail-closed: no
+ *    allowlist means nothing is allowed — NOT the bare task policy).
+ * When NO frame is active, the policy returns `allow` for everything (it only ever subtracts), leaving
+ * the task policy unmodified — so a skill WITHOUT a manifest, or a task before any skill load, behaves
+ * exactly as before (backward-compatible).
+ *
+ * This policy must be composed via `combinePolicies(scopePolicy, taskPolicy)` so its `deny`
+ * short-circuits the fold and a task-policy `allow` can never widen it.
+ *
+ * `env`/`rootPath` are the SAME execution env + tracked cwd the hand tools resolve against, so
+ * `allowPaths` matching sees the task's real filesystem (a remote/E2B task resolves in its container).
+ */
+export declare function createActiveSkillScopePolicy(opts: {
+    scope: ActiveSkillScope;
+    env: ExecutionEnv;
+    rootPath?: string;
+    /** Per-tool side-effect class (the SAME `toolEffects` map prepare-task builds). Lets the scope policy
+     *  fail CLOSED on a mutating tool that `allowPaths` can NOT confine (e.g. `bash` — no parseable path):
+     *  while an `allowPaths` constraint is active, such a tool is DENIED, never allowed to write anywhere. */
+    toolEffects?: ReadonlyMap<string, ToolEffect>;
+}): ToolPolicy;
+//# sourceMappingURL=active-skill-scope.d.ts.map

package/dist/core/runner/active-skill-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"active-skill-scope.d.ts","sourceRoot":"","sources":["../../../src/core/runner/active-skill-scope.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,KAAK,EAAqC,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGvF;kFACkF;AAClF,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D;;;;;GAKG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IAEjD,kFAAkF;IAClF,IAAI,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI;IAInC;wGACoG;IACpG,GAAG,IAAI,gBAAgB,GAAG,SAAS;IAInC,2FAA2F;IAC3F,MAAM,IAAI,SAAS,gBAAgB,EAAE;IAIrC,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAMD;;;qDAGqD;AACrD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAWzD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE;IACjD,KAAK,EAAE,gBAAgB,CAAC;IACxB,GAAG,EAAE,YAAY,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;8GAE0G;IAC1G,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CAC/C,GAAG,UAAU,CA4Gb"}

package/dist/core/runner/active-skill-scope.js

@@ -0,0 +1,197 @@
+// design/77 §3 — Gate-3: per-artifact manifest → ToolPolicy deny-narrowing (the RUNTIME-SCOPING
+// mechanism only). When a skill carrying a `manifest` is loaded, the rest of the invocation is scoped
+// at runtime to ONLY the tools/paths in that manifest — for the duration of the skill's frame — via a
+// composable `ToolPolicy` folded into the gate's adjudicate chain.
+//
+// Why this is SAFE by construction (design/77 §3 / §8 G3): the scope policy can only ever return
+// `allow` or `deny`. It is composed BEFORE the caller's task policy inside `combinePolicies`, whose
+// fold is `deny > ask > allow` with a deny short-circuit (tool-policy.ts:196). So a scope `deny`
+// outranks any task-policy `allow` — the manifest can only SUBTRACT capability, never add it. An
+// attacker who controls a manifest can therefore only further restrict the run, never widen it. Worst
+// case (the model never pops the frame) = no narrowing applied yet, never a widening — still ⊆ task
+// policy. Nested skills compose MONOTONICALLY: the allowed set is the INTERSECTION of every active
+// frame's `allowTools`, so a child skill can only narrow further, never re-grant what a parent removed.
+//
+// 🔴 KNOWN RESIDUAL — NOT solved here (design/77 §3 / §7 "ON 前必关"): a skill that spawns a SUBAGENT
+// (design/38 Path A) does NOT propagate its manifest scope into the child task — the child has its own
+// `prepare-task` and adjudicate chain and runs UNMANIFESTED. v1 scope applies WITHIN the task only;
+// threading the scope across the subagent boundary is an explicitly-deferred future must-close before
+// auto-promote can turn ON. This slice deliberately does not attempt it.
+//
+// Secondary residual (design/77 §3): the scope stack is in-process worker state (the 2-of-3 asymmetry,
+// in-process axis) and its lifetime is heuristic — the model controls its own turns; we push on a
+// successful skill load and pop on the next skill load (LIFO) / task end. Worst case = no narrowing.
+import { canonicalizeTarget, fileArgPath } from "../../tools/fs/safety.js";
+import { canonicalToolName } from "../tool-name-aliases.js";
+/**
+ * The per-task LIFO stack of active skill frames (design/77 §3). Owned by `prepare-task`'s closure;
+ * the injected `skill` tool pushes onto it on a successful load, and a deny-narrowing policy reads it
+ * on every tool call. A simple array is the stack — `push` on load, and the policy reads ALL frames
+ * currently on it (the intersection). v1 keeps lifetime heuristic (see module header).
+ */
+export class ActiveSkillScope {
+    frames = [];
+    /** Push a resolved manifest frame (skill loaded successfully WITH a manifest). */
+    push(frame) {
+        this.frames.push(frame);
+    }
+    /** Pop the most-recently-pushed frame (LIFO). Returns it, or undefined when empty. v1 surfaces this
+     *  for the "next-skill-load pops the previous sibling frame" lifetime — see prepare-task wiring. */
+    pop() {
+        return this.frames.pop();
+    }
+    /** Snapshot of the live frames (a copy — callers must not mutate the stack through it). */
+    active() {
+        return [...this.frames];
+    }
+    get size() {
+        return this.frames.length;
+    }
+}
+/** Tool names that take a writable `path` arg and are narrowed by `allowPaths` (mirrors the
+ *  sensitive-path guard's guarded set — only these expose a parseable, write-able target). */
+const PATH_WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit"]);
+/** Path-segment-aware containment, FAMILY-AWARE ([K-PLATFORM-SWEEP] MAJOR#2: canonical keys are
+ *  backslash-form on a win32 env — the "/"-hardcoded suffix rejected every legitimate write there).
+ *  Compare in "/" form with drive-letter case folded; never keyed on process.platform (the env may be
+ *  remote and of the OTHER family than the host). */
+export function isWithin(root, p) {
+    const norm = (x) => {
+        let n = x.replace(/\\/g, "/");
+        if (/^[A-Za-z]:(\/|$)/.test(n))
+            n = n[0].toLowerCase() + n.slice(1);
+        return n;
+    };
+    const r = norm(root);
+    const c = norm(p);
+    if (c === r)
+        return true;
+    const base = r.endsWith("/") ? r : r + "/";
+    return c.startsWith(base);
+}
+/**
+ * Build the Gate-3 deny-narrowing policy over a live {@link ActiveSkillScope} (design/77 §3). For each
+ * tool call, WHILE any skill frame is active:
+ *  - DENY any tool not in the INTERSECTION of every active frame's `allowTools`.
+ *  - For a WRITE tool with an `allowPaths` constraint on ANY active frame, DENY a write whose
+ *    canonicalized target is outside every listed prefix (reuses {@link canonicalizeTarget}, so a
+ *    symlink can't smuggle a write outside the allowed paths).
+ *  - A frame whose manifest could not be resolved (`kind:"unresolved"`) → DENY-ALL (fail-closed: no
+ *    allowlist means nothing is allowed — NOT the bare task policy).
+ * When NO frame is active, the policy returns `allow` for everything (it only ever subtracts), leaving
+ * the task policy unmodified — so a skill WITHOUT a manifest, or a task before any skill load, behaves
+ * exactly as before (backward-compatible).
+ *
+ * This policy must be composed via `combinePolicies(scopePolicy, taskPolicy)` so its `deny`
+ * short-circuits the fold and a task-policy `allow` can never widen it.
+ *
+ * `env`/`rootPath` are the SAME execution env + tracked cwd the hand tools resolve against, so
+ * `allowPaths` matching sees the task's real filesystem (a remote/E2B task resolves in its container).
+ */
+export function createActiveSkillScopePolicy(opts) {
+    const { scope, env, rootPath, toolEffects } = opts;
+    return {
+        async check(req, signal) {
+            // durable compat: a resumed checkpoint may carry a pre-rename persisted tool name; manifest allowlists hold
+            // the new (CC) names, so canonicalize before every set/map lookup (identity for live new names).
+            const toolName = canonicalToolName(req.toolName);
+            const frames = scope.active();
+            if (frames.length === 0)
+                return { action: "allow" }; // no active manifest → no narrowing
+            // Fail-closed: any unresolved frame means a loaded skill's manifest is unknown → DENY-ALL.
+            const unresolved = frames.find((f) => f.kind === "unresolved");
+            if (unresolved && unresolved.kind === "unresolved") {
+                return {
+                    action: "deny",
+                    reason: `tool "${req.toolName}" denied: active skill artifact "${unresolved.lineageId}" manifest could not be resolved (${unresolved.reason}) — fail-closed deny-all`,
+                    decisionReason: "safety",
+                };
+            }
+            // INTERSECTION of allowTools across every active manifest frame (nested = monotonic narrowing).
+            // Start from the first frame's set and intersect the rest, so a tool must be in ALL of them.
+            const manifests = frames.flatMap((f) => (f.kind === "manifest" ? [f.manifest] : []));
+            let allowed;
+            for (const m of manifests) {
+                const here = new Set(m.allowTools.map(canonicalToolName));
+                allowed = allowed === undefined ? here : new Set([...allowed].filter((t) => here.has(t)));
+            }
+            // `allowed` is defined here (manifests is non-empty: unresolved handled above, frames non-empty).
+            if (!allowed || !allowed.has(toolName)) {
+                const ids = manifests.map((m) => m.lineageId).join(", ");
+                return {
+                    action: "deny",
+                    reason: `tool "${req.toolName}" is not in the active skill manifest allowlist (artifact(s): ${ids})`,
+                    decisionReason: "safety",
+                };
+            }
+            // FIX (fail-closed, MAJOR-2): `allowPaths` only confines tools we can parse a write target from
+            // (PATH_WRITE_TOOLS). A mutating tool we CANNOT path-confine — `bash`, or any allowlisted effect:write/
+            // idempotent tool that is not in PATH_WRITE_TOOLS — would otherwise BYPASS allowPaths entirely and write/
+            // egress anywhere. So while ANY active frame constrains paths, DENY such a tool (mirrors the no-resolvable-
+            // path deny below: a write that can't be proven inside the allowed set is denied, not allowed). Reads are
+            // unaffected — `allowPaths` restricts capability, not visibility (a read tool can't write outside it).
+            const pathConstrainingActive = manifests.some((m) => m.allowPaths && m.allowPaths.length > 0);
+            if (pathConstrainingActive && !PATH_WRITE_TOOLS.has(toolName)) {
+                // 🔴 Conservative default (verify-round-2 MAJOR): `effect` is OPTIONAL on ToolSpec (types.ts) and
+                // effect-less tools are legal — the codebase convention is "unknown ⇒ write" (prepare-task.ts:188-189,
+                // and the sibling `?? "write"` one line over). `toolEffects` only carries tools that DECLARED an effect,
+                // so a custom effect-less write tool would read back `undefined` and slip the deny. Treat undefined as
+                // write: only an EXPLICIT `read` is allowed to bypass path-confinement; anything else fails closed.
+                const eff = toolEffects?.get(toolName) ?? "write";
+                if (eff !== "read") {
+                    const ids = manifests.filter((m) => m.allowPaths?.length).map((m) => m.lineageId).join(", ");
+                    return {
+                        action: "deny",
+                        reason: `write-capable tool "${req.toolName}" denied: active skill manifest constrains writes to allowPaths but this tool's target cannot be path-confined (only ${[...PATH_WRITE_TOOLS].join("/")} are) — fail-closed (artifact(s): ${ids})`,
+                        decisionReason: "safety",
+                    };
+                }
+            }
+            // Path narrowing for write tools: a write must land inside the allowPaths of EVERY frame that
+            // constrains them. A frame with no `allowPaths` does not constrain paths (only `allowTools`).
+            if (PATH_WRITE_TOOLS.has(toolName)) {
+                const constraining = manifests.filter((m) => m.allowPaths && m.allowPaths.length > 0);
+                if (constraining.length > 0) {
+                    const path = fileArgPath(req.args); // batch-B: CC `file_path` or legacy `path` (else a file_path write is wrongly denied)
+                    if (typeof path !== "string" || path.length === 0) {
+                        // A write tool with no parseable path while a path constraint is active → fail-closed deny
+                        // (we can't prove it lands inside the allowed set).
+                        return {
+                            action: "deny",
+                            reason: `write tool "${req.toolName}" denied: active skill manifest constrains writes to allowPaths but the call has no resolvable path`,
+                            decisionReason: "safety",
+                        };
+                    }
+                    const canon = await canonicalizeTarget(env, path, signal, rootPath);
+                    if (!canon.ok) {
+                        // Cannot resolve the real target (unresolvable symlink / bad path) → fail-closed deny: it
+                        // could resolve outside the allowed paths (mirrors the sensitive-path guard's symlink stance).
+                        return {
+                            action: "deny",
+                            reason: `write to "${path}" denied: its real target could not be resolved against the active skill manifest allowPaths`,
+                            decisionReason: "safety",
+                        };
+                    }
+                    for (const m of constraining) {
+                        const roots = [];
+                        for (const raw of m.allowPaths ?? []) {
+                            const r = await canonicalizeTarget(env, raw, signal, rootPath);
+                            if (r.ok)
+                                roots.push(r.key);
+                        }
+                        const inside = roots.some((root) => isWithin(root, canon.key));
+                        if (!inside) {
+                            return {
+                                action: "deny",
+                                reason: `write to "${path}" is outside the paths allowed by skill manifest "${m.lineageId}" (allowPaths: ${(m.allowPaths ?? []).join(", ")})`,
+                                decisionReason: "safety",
+                            };
+                        }
+                    }
+                }
+            }
+            return { action: "allow" };
+        },
+    };
+}
+//# sourceMappingURL=active-skill-scope.js.map

package/dist/core/runner/active-skill-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"active-skill-scope.js","sourceRoot":"","sources":["../../../src/core/runner/active-skill-scope.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,sGAAsG;AACtG,sGAAsG;AACtG,mEAAmE;AACnE,EAAE;AACF,iGAAiG;AACjG,oGAAoG;AACpG,iGAAiG;AACjG,iGAAiG;AACjG,sGAAsG;AACtG,oGAAoG;AACpG,mGAAmG;AACnG,wGAAwG;AACxG,EAAE;AACF,mGAAmG;AACnG,uGAAuG;AACvG,oGAAoG;AACpG,sGAAsG;AACtG,yEAAyE;AACzE,EAAE;AACF,uGAAuG;AACvG,kGAAkG;AAClG,qGAAqG;AAErG,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAI3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAQ5D;;;;;GAKG;AACH,MAAM,OAAO,gBAAgB;IACV,MAAM,GAAuB,EAAE,CAAC;IAEjD,kFAAkF;IAClF,IAAI,CAAC,KAAuB;QAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED;wGACoG;IACpG,GAAG;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IAC3B,CAAC;IAED,2FAA2F;IAC3F,MAAM;QACJ,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IAC5B,CAAC;CACF;AAED;8FAC8F;AAC9F,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AAEtF;;;qDAGqD;AACrD,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,CAAS;IAC9C,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE;QACjC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpE,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;IAC3C,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAQ5C;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACnD,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,GAAoB,EAAE,MAAoB;YACpD,4GAA4G;YAC5G,iGAAiG;YACjG,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,oCAAoC;YAEzF,2FAA2F;YAC3F,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;YAC/D,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACnD,OAAO;oBACL,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,SAAS,GAAG,CAAC,QAAQ,oCAAoC,UAAU,CAAC,SAAS,qCAAqC,UAAU,CAAC,MAAM,0BAA0B;oBACrK,cAAc,EAAE,QAAQ;iBACzB,CAAC;YACJ,CAAC;YAED,gGAAgG;YAChG,6FAA6F;YAC7F,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACrF,IAAI,OAAgC,CAAC;YACrC,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBAC1D,OAAO,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5F,CAAC;YACD,kGAAkG;YAClG,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzD,OAAO;oBACL,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,SAAS,GAAG,CAAC,QAAQ,iEAAiE,GAAG,GAAG;oBACpG,cAAc,EAAE,QAAQ;iBACzB,CAAC;YACJ,CAAC;YAED,gGAAgG;YAChG,wGAAwG;YACxG,0GAA0G;YAC1G,4GAA4G;YAC5G,0GAA0G;YAC1G,uGAAuG;YACvG,MAAM,sBAAsB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC9F,IAAI,sBAAsB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9D,kGAAkG;gBAClG,uGAAuG;gBACvG,yGAAyG;gBACzG,uGAAuG;gBACvG,oGAAoG;gBACpG,MAAM,GAAG,GAAG,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC;gBAClD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;oBACnB,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC7F,OAAO;wBACL,MAAM,EAAE,MAAM;wBACd,MAAM,EAAE,uBAAuB,GAAG,CAAC,QAAQ,wHAAwH,CAAC,GAAG,gBAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,qCAAqC,GAAG,GAAG;wBAC7O,cAAc,EAAE,QAAQ;qBACzB,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,8FAA8F;YAC9F,8FAA8F;YAC9F,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnC,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACtF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC5B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,sFAAsF;oBAC1H,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBAClD,2FAA2F;wBAC3F,oDAAoD;wBACpD,OAAO;4BACL,MAAM,EAAE,MAAM;4BACd,MAAM,EAAE,eAAe,GAAG,CAAC,QAAQ,qGAAqG;4BACxI,cAAc,EAAE,QAAQ;yBACzB,CAAC;oBACJ,CAAC;oBACD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;oBACpE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;wBACd,0FAA0F;wBAC1F,+FAA+F;wBAC/F,OAAO;4BACL,MAAM,EAAE,MAAM;4BACd,MAAM,EAAE,aAAa,IAAI,8FAA8F;4BACvH,cAAc,EAAE,QAAQ;yBACzB,CAAC;oBACJ,CAAC;oBACD,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;wBAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;wBAC3B,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;4BACrC,MAAM,CAAC,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;4BAC/D,IAAI,CAAC,CAAC,EAAE;gCAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;wBAC9B,CAAC;wBACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;wBAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;4BACZ,OAAO;gCACL,MAAM,EAAE,MAAM;gCACd,MAAM,EAAE,aAAa,IAAI,qDAAqD,CAAC,CAAC,SAAS,kBAAkB,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gCAC7I,cAAc,EAAE,QAAQ;6BACzB,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC"}