@springbrand/agent-runtime 0.2.0-alpha.42 → 0.2.0-alpha.43

package/src/pi/tool/core-host.ts

@@ -1,7 +1,13 @@
 import {
   createWorkspaceStateBackend,
+  type StateBackend,
   type WorkspaceFsLike,
 } from "@cloudflare/shell";
+import {
+  truncateResponse,
+  truncateResult,
+  type ProxyToolOutput,
+} from "@cloudflare/codemode";
 import { createBrowserTools } from "@cloudflare/think/tools/browser";
 import { createExecuteRuntime } from "@cloudflare/think/tools/execute";
 import type { AgentToolResult } from "@earendil-works/pi-agent-core";
@@ -20,41 +26,77 @@ import { piCandidatesToAiTools } from "./nested-tools";
 // 本文件沿用 `../../index.ts` 入口定义的 Workspace、Port 和 Tool Candidate 术语。
 
 const CODEMODE_SANDBOX_TIMEOUT_MS = 55_000;
+export type WorkspaceAccessMode = "none" | "read" | "write";
+const WRITE_STATE_METHODS = new Set([
+  "writeFile",
+  "writeFileBytes",
+  "appendFile",
+  "writeJson",
+  "updateJson",
+  "mkdir",
+  "replaceInFile",
+  "replaceInFiles",
+  "rm",
+  "cp",
+  "mv",
+  "symlink",
+  "createArchive",
+  "extractArchive",
+  "compressFile",
+  "decompressFile",
+  "removeTree",
+  "copyTree",
+  "moveTree",
+  "planEdits",
+  "applyEditPlan",
+  "applyEdits",
+]);
 
-function directoryEntry(name: string, label: string): string {
-  const singleLineLabel = label.replaceAll(/\s+/g, " ").trim().replaceAll("`", "'");
-  return `- \`${name}\` — ${singleLineLabel}`;
+export function workspaceStateBackend(
+  workspace: WorkspacePort,
+  mode: WorkspaceAccessMode,
+): StateBackend | undefined {
+  if (mode === "none") return undefined;
+  const backend = createWorkspaceStateBackend(
+    workspace as unknown as WorkspaceFsLike,
+  );
+  return new Proxy(backend, {
+    get(target, property, receiver) {
+      if (property === "writeFileBytes") return undefined;
+      if (
+        mode === "read" &&
+        typeof property === "string" &&
+        WRITE_STATE_METHODS.has(property)
+      ) {
+        return async () => {
+          throw new Error("Workspace state is read-only for this execution");
+        };
+      }
+      const value = Reflect.get(target, property, receiver);
+      return typeof value === "function" ? value.bind(target) : value;
+    },
+  }) as StateBackend;
 }
 
-function codeExecutionDescription(
-  candidates: readonly PiToolCandidate[],
-): string {
-  const list = (
-    entries: readonly { readonly name: string; readonly label: string }[],
-  ) => entries.length > 0
-    ? entries.map(({ name, label }) => directoryEntry(name, label)).join("\n")
-    : "- None.";
+const SPRINGBRAND_CODE_MODE_POLICY = `## SpringBrand Workspace and Asset Policy
 
-  return [
-    "Execute plain JavaScript in a sandbox using the exact Tool directory below.",
-    "",
-    "## `tools.*` Available",
-    list(candidates.map(({ tool }) => ({
-      name: tool.name,
-      label: tool.label ?? tool.name,
-    }))),
-    "",
-    "Call only the methods listed above through `tools.*`; never guess or construct a method name.",
-    "Use `codemode.describe(\"tools.method\")` when you need the exact input type for a listed method.",
-    "`codemode.search` cannot add methods to `tools.*` or load top-level Tools; it searches only connector methods and snippets already installed in this Code Mode Runtime.",
-    "Use `state.*` for the Workspace filesystem. Every method takes one object argument, for example `state.readFile({ path })` and `state.writeFile({ path, content })`.",
-    "Wrap raw fetch, random values, time, and other nondeterministic work in `codemode.step(name, fn)` so replay runs them once.",
-    "Some connector methods pause for approval and resume automatically. Do not re-issue paused code.",
-    "Keep all code outside connector calls and `codemode.step` deterministic.",
-    "Raw `fetch` is available inside `codemode.step(...)`; prefer connector SDKs when one owns the target.",
-    "There is no Node.js `require`, `process`, package manager, or Python runtime.",
-  ].join("\n");
-}
+Use state.* for every Workspace filesystem operation. Workspace file methods do not exist under tools.*.
+
+state.writeFileBytes is not available. Use state.writeFile or state.appendFile for sandbox-created text.
+
+Bundled Skill resources are not Workspace files. Read text with tools.read_skill_resource, run bundled scripts with tools.run_skill_script, and copy templates or assets with tools.materialize_skill_resource.
+
+User Attachments are not Workspace files until copied with tools.materialize_attachment.
+
+Never create or write data URLs, base64 image strings, or embedded binary payloads in Code Mode.
+
+Copy a remote asset into Workspace with tools.materialize_url({ url, destination }). Raw fetch remains available. Do not carry large responses, binary payloads, data URLs, or base64 assets through Code Mode.
+
+After materialization, reference the Workspace file by a relative path. Website HTML and CSS must reference relative Workspace assets, never temporary external URLs or data URLs.
+
+Keep large content out of the execute result. Write it to Workspace and return only path, mediaType, bytes, summary, and warnings.
+
+This execute tool cannot ask the user, inspect a rendered page, capture a screenshot, save or publish a Creation, or authorize an external action. Use the corresponding top-level Tool for those operations.`;
 
 /**
  * 宿主的 Browser Rendering 绑定，只取本仓真正用到的那一面。
@@ -130,6 +172,42 @@ function codeExecutionResult(
   };
 }
 
+function projectCodeModeResult(details: unknown): unknown {
+  if (typeof details !== "object" || details === null) {
+    return { status: "error", executionId: "unknown", error: truncateResponse(String(details)) };
+  }
+  const output = details as ProxyToolOutput;
+  const calls = Array.isArray(output.calls) ? output.calls : [];
+  const callSummary = calls.length > 0
+    ? {
+        total: calls.length,
+        failed: calls.filter(({ state }) => state === "error").length,
+        methods: [...new Set(calls.map(({ method }) => method))]
+          .map((method) => truncateResponse(method, { maxChars: 256 }))
+          .slice(0, 100),
+      }
+    : undefined;
+  const common = {
+    status: output.status,
+    executionId: output.executionId,
+    ...(callSummary ? { callSummary } : {}),
+  };
+  if (output.status === "completed") {
+    return { ...common, result: truncateResult(output.result) };
+  }
+  if (output.status === "paused") {
+    return {
+      ...common,
+      pending: output.pending.slice(0, 100).map(({ connector, method, seq }) => ({
+        connector: truncateResponse(connector, { maxChars: 256 }),
+        method: truncateResponse(method, { maxChars: 256 }),
+        seq,
+      })),
+    };
+  }
+  return { ...common, error: truncateResponse(output.error) };
+}
+
 // 上游把 Code Mode 类工具交付为 AI SDK tool；本仓只取 description 和 execute 两件，
 // 并在这里就地校验，使装配期缺件立刻失败，而不是等模型调用时才炸。
 function toCodeExecutionPort(
@@ -246,35 +324,42 @@ export function createWorkspaceCodeExecutionFactory(options: {
   readonly loader: WorkerLoader;
   readonly outbound: Fetcher;
   readonly workspace: WorkspacePort;
+  readonly workspaceAccessMode: WorkspaceAccessMode;
 }): RuntimeCodeExecutionFactory {
   return {
     create(candidates) {
-      const description = codeExecutionDescription(candidates);
+      const state = workspaceStateBackend(
+        options.workspace,
+        options.workspaceAccessMode,
+      );
+      const createPort = (innerResults: AgentToolResult<unknown>[]) => {
+        let nestedCallOrdinal = 0;
+        const { tool } = createExecuteRuntime({
+          ctx: options.ctx,
+          loader: options.loader,
+          globalOutbound: options.outbound,
+          tools: piCandidatesToAiTools(candidates, {
+            fallbackToolCallId: (name) =>
+              `codemode:${++nestedCallOrdinal}:${name}`,
+            onResult: (value) => innerResults.push(value),
+          }),
+          timeout: CODEMODE_SANDBOX_TIMEOUT_MS,
+          ...(state ? { state } : {}),
+          name: "execute",
+        });
+        return toCodeExecutionPort(
+          tool,
+          "execute",
+          (details) => codeExecutionResult(
+            projectCodeModeResult(details),
+            innerResults,
+          ),
+        );
+      };
+      const description = createPort([]).description;
       return {
-        description,
-        async execute(input) {
-          const innerResults: AgentToolResult<unknown>[] = [];
-          const { tool } = createExecuteRuntime({
-            ctx: options.ctx,
-            loader: options.loader,
-            globalOutbound: options.outbound,
-            tools: piCandidatesToAiTools(candidates, {
-              onResult: (value) => innerResults.push(value),
-            }),
-            description,
-            // 先于外层 60s 截止结束，给 Runtime RPC 结算和 Worker 释放留出时间。
-            timeout: CODEMODE_SANDBOX_TIMEOUT_MS,
-            state: createWorkspaceStateBackend(
-              options.workspace as unknown as WorkspaceFsLike,
-            ),
-            name: "execute",
-          });
-          return toCodeExecutionPort(
-            tool,
-            "execute",
-            (details) => codeExecutionResult(details, innerResults),
-          ).execute(input);
-        },
+        description: `${description}\n\n${SPRINGBRAND_CODE_MODE_POLICY}`,
+        execute: (input) => createPort([]).execute(input),
       };
     },
   };

package/src/pi/tool/core.ts

@@ -165,7 +165,7 @@ function browserResult(details: unknown): AgentToolResult<unknown> {
 
 // #region Extension discovery
 
-const noParameters = Type.Object({});
+const noParameters = Type.Object({}, { additionalProperties: false });
 
 /**
  * 为当前已加载 Extension 列表创建一个 Pi 工具候选项。
@@ -207,10 +207,11 @@ export function listExtensionsPiToolCandidate(
 const executeParameters = Type.Object({
   code: Type.String({
     minLength: 1,
+    maxLength: 131_072,
     description:
       "Plain JavaScript async function. TypeScript annotations are not supported.",
   }),
-});
+}, { additionalProperties: false });
 const CODEMODE_EXECUTE_TIMEOUT_MS = 60_000;
 
 // 把模型提供的代码交给 Codemode Runtime 执行，并在外层再压一道截止。

package/src/pi/tool/declared.ts

@@ -49,7 +49,7 @@ export interface PiDeclaredToolPolicy<Reply = unknown> {
   readonly modelName: string;
   readonly requiredExecutionLevel: PiToolCandidate["requiredExecutionLevel"];
   readonly requiredExecutionLevelForInput?: PiToolCandidate["requiredExecutionLevelForInput"];
-  readonly direct?: true;
+  readonly exposureMode?: PiToolCandidate["exposureMode"];
   readonly retry?: PiToolCandidate["retry"];
   readonly source?: PiToolCandidate["source"];
   readonly summary?: string;
@@ -105,6 +105,7 @@ export function createPiDeclaredToolCandidate<Reply = unknown>(
     parameters: structuredClone(
       declared.inputSchema ?? { type: "object", additionalProperties: true },
     ) as AgentTool["parameters"],
+    constrainedSampling: false,
     execute: async (toolCallId, input, signal) =>
       project(await call(input as Record<string, unknown>, { toolCallId, signal })),
   };
@@ -116,7 +117,7 @@ export function createPiDeclaredToolCandidate<Reply = unknown>(
     ...(policy.requiredExecutionLevelForInput
       ? { requiredExecutionLevelForInput: policy.requiredExecutionLevelForInput }
       : {}),
-    ...(policy.direct ? { direct: policy.direct } : {}),
+    ...(policy.exposureMode ? { exposureMode: policy.exposureMode } : {}),
     ...(policy.retry ? { retry: policy.retry } : {}),
     ...(policy.source ? { source: policy.source } : {}),
   };

package/src/pi/tool/nested-tools.ts

@@ -35,7 +35,11 @@ export function piCandidatesToAiTools(
           call?.abortSignal ?? new AbortController().signal,
         );
         options.onResult?.(result);
-        return result;
+        if (result.details !== undefined) return result.details;
+        const [only] = result.content;
+        return result.content.length === 1 && only?.type === "text"
+          ? only.text
+          : result.content;
       },
     }),
   ]));

package/src/pi/tool/schedule.ts

@@ -18,28 +18,28 @@ const scheduleTriggerParameters = Type.Union([
       minimum: 1,
       description: "Fire once, this many seconds from now.",
     }),
-  }),
+  }, { additionalProperties: false }),
   Type.Object({
     kind: Type.Literal("once-at"),
     at: Type.String({
       description:
         "Fire once at this absolute UTC ISO time, e.g. 2026-07-20T09:00:00Z.",
     }),
-  }),
+  }, { additionalProperties: false }),
   Type.Object({
     kind: Type.Literal("cron"),
     cron: Type.String({
       description:
         "Repeat on a standard UTC cron, e.g. '0 9 * * *' = daily 09:00 UTC.",
     }),
-  }),
+  }, { additionalProperties: false }),
   Type.Object({
     kind: Type.Literal("interval"),
     seconds: Type.Integer({
       minimum: 1,
       description: "Repeat every this many seconds.",
     }),
-  }),
+  }, { additionalProperties: false }),
 ], { description: "When to fire." });
 
 const scheduleParameters = Type.Object({
@@ -56,21 +56,21 @@ const scheduleParameters = Type.Object({
     description:
       "IANA timezone the clock times in `trigger` should be interpreted in, e.g. 'Asia/Shanghai'. Pass the user's own timezone whenever they state a wall-clock time. Omit only for delays and intervals. Defaults to UTC.",
   })),
-});
+}, { additionalProperties: false });
 
-const noParameters = Type.Object({});
+const noParameters = Type.Object({}, { additionalProperties: false });
 const scheduleIdParameters = Type.Object({
   id: Type.String({
     description: "The schedule id, as returned by `list_schedules`.",
   }),
-});
+}, { additionalProperties: false });
 const updateScheduleParameters = Type.Object({
   id: Type.String({ description: "The exact id returned by `list_schedules`." }),
   prompt: Type.Optional(Type.String()),
   trigger: Type.Optional(scheduleTriggerParameters),
   label: Type.Optional(Type.String()),
   timezone: Type.Optional(Type.String()),
-});
+}, { additionalProperties: false });
 const changeScheduleAgentParameters = Type.Object({
   id: Type.String({
     description: "The exact schedule id returned by `list_schedules`.",
@@ -78,7 +78,7 @@ const changeScheduleAgentParameters = Type.Object({
   userAgentId: Type.String({
     description: "The exact User Agent id selected by the user.",
   }),
-});
+}, { additionalProperties: false });
 
 function result<T>(details: T): AgentToolResult<T> {
   return {
@@ -92,19 +92,19 @@ function candidate<T extends TSchema>(
   options: Partial<
     Pick<
       PiToolCandidate,
-      "alwaysRequiresApproval" | "direct" | "owner" | "requiredExecutionLevel" | "summary"
+      "alwaysRequiresApproval" | "exposureMode" | "owner" | "requiredExecutionLevel" | "summary"
     >
   > = {},
 ): PiToolCandidate {
   return {
     owner: options.owner ?? "runtime-base",
+    exposureMode: options.exposureMode ?? "direct",
     requiredExecutionLevel: options.requiredExecutionLevel ?? "safe",
     source: "action",
     tool,
     ...(options.alwaysRequiresApproval
       ? { alwaysRequiresApproval: true }
       : {}),
-    ...(options.direct ? { direct: true } : {}),
     ...(options.summary ? { summary: options.summary } : {}),
   };
 }
@@ -134,7 +134,7 @@ export function schedulePiToolCandidates(
       },
       {
         alwaysRequiresApproval: true,
-        direct: true,
+        exposureMode: "direct",
         summary: "Create a scheduled task",
       },
     ),

package/src/pi/tool/skill.ts

@@ -6,12 +6,15 @@ import {
   type SkillScriptRunner,
   type SkillSource,
 } from "agents/skills";
+import { truncateResponse, truncateResult } from "@cloudflare/codemode";
 import { tool } from "ai";
 import { z } from "zod";
 import type {
   RuntimeSkillScriptPolicy,
   WorkspacePort,
 } from "../../kernel/bindings";
+import { STORAGE_LEAF_MAX_CHARS } from "../../layers/context/budget/gate";
+import { serializeOutput } from "../../lib/artifacts";
 import { aiToolToPi } from "./ai-adapter";
 import type { PiToolCandidate } from "./compiler";
 import { piCandidatesToAiTools } from "./nested-tools";
@@ -48,9 +51,10 @@ type LoadedSkill = NonNullable<Awaited<ReturnType<SkillSource["load"]>>>;
 
 const SKILL_RESOURCE_READ_GUIDANCE =
   "Bundled Skill resources are not Workspace files. " +
-  "Use read_skill_resource for text instead of read, bash, or find on /skills.";
+  "Inside execute, use tools.read_skill_resource for text instead of state.* on /skills.";
 const SKILL_RESOURCE_MATERIALIZE_GUIDANCE =
-  "Use materialize_skill_resource for Workspace assets when that Tool is available.";
+  "Inside execute, use tools.materialize_skill_resource for Workspace assets when available.";
+const SKILL_SCRIPT_OUTPUT_ROOT = "/scratch/skill-output";
 
 /**
  * 按体积裁掉超预算的 Skill 资源，并把裁掉的事实写回 Skill 正文。
@@ -227,6 +231,127 @@ function normalizeRunSkillScriptArguments(input: unknown): unknown {
   }
 }
 
+function result(details: unknown) {
+  return {
+    content: [{ type: "text" as const, text: serializeOutput(details).text }],
+    details,
+  };
+}
+
+function resourceTarget(
+  bindings: readonly PiSkillBinding[],
+  input: unknown,
+): { binding: PiSkillBinding; path: string } | null {
+  if (input === null || typeof input !== "object") return null;
+  const target = input as { name?: unknown; path?: unknown };
+  if (typeof target.path !== "string") return null;
+  if (typeof target.name === "string") {
+    const binding = bindings.find(({ name }) => name === target.name);
+    return binding ? { binding, path: target.path } : null;
+  }
+  const [name, ...rest] = target.path.split("/");
+  const binding = bindings.find((candidate) => candidate.name === name);
+  return binding && rest.length > 0
+    ? { binding, path: rest.join("/") }
+    : null;
+}
+
+function materializationRequired(name: string, path: string, bytes?: number) {
+  return result({
+    status: "materialization_required",
+    name,
+    path,
+    ...(bytes === undefined ? {} : { bytes }),
+    next: "tools.materialize_skill_resource",
+  });
+}
+
+type ScriptOutputFile = {
+  path?: unknown;
+  content?: unknown;
+  encoding?: unknown;
+  mimeType?: unknown;
+};
+
+function scratchSegment(value: string): string {
+  const segment = value.replace(/[^a-zA-Z0-9._-]+/g, "_");
+  return !segment || segment === "." || segment === ".." ? "_" : segment;
+}
+
+function outputRelativePath(value: unknown): string {
+  const path = String(value ?? "output.txt").replace(/^\/?output\//, "");
+  const parts = path.split("/");
+  if (parts.some((part) => !part || part === "." || part === "..")) {
+    throw new Error(`Invalid Skill output path: ${path}`);
+  }
+  return parts.join("/");
+}
+
+async function projectSkillScriptResult(
+  details: unknown,
+  input: unknown,
+  toolCallId: string,
+  workspace: WorkspacePort | undefined,
+  signal: AbortSignal | undefined,
+): Promise<unknown> {
+  const record = details !== null && typeof details === "object"
+    ? details as Record<string, unknown>
+    : null;
+  const outputFiles = Array.isArray(record?.outputFiles)
+    ? record.outputFiles as ScriptOutputFile[]
+    : [];
+  const target = input as { name?: unknown };
+  const outputs: Array<{ path: string; bytes: number; mediaType?: string }> = [];
+  if (outputFiles.length > 0 && !workspace) {
+    throw new Error("Skill output files require Workspace access");
+  }
+  for (const file of outputFiles) {
+    signal?.throwIfAborted();
+    const relative = outputRelativePath(file.path);
+    const destination = `${SKILL_SCRIPT_OUTPUT_ROOT}/${scratchSegment(String(target.name ?? "skill"))}/${scratchSegment(toolCallId)}/${relative}`;
+    const content = String(file.content ?? "");
+    const binary = file.encoding === "base64";
+    const mediaType = typeof file.mimeType === "string"
+      ? file.mimeType
+      : binary ? "application/octet-stream" : "text/plain";
+    let bytes = new Blob([content]).size;
+    await serializeWorkspaceMutation(workspace!, destination, async () => {
+      const parent = destination.replace(/\/[^/]+$/, "");
+      await workspace!.mkdir(parent, { recursive: true });
+      if (!binary) {
+        await workspace!.writeFile(destination, content, mediaType);
+        return;
+      }
+      const decoded = resourceBytes({
+        path: relative,
+        kind: "file",
+        encoding: "base64",
+        content,
+      });
+      bytes = decoded.byteLength;
+      await workspace!.writeFileBytes(destination, decoded, mediaType);
+    });
+    outputs.push({ path: destination, bytes, mediaType });
+  }
+  const scriptResult = record && "result" in record
+    ? record.result
+    : record && ("outputFiles" in record || "logs" in record)
+    ? Object.fromEntries(Object.entries(record).filter(([key]) =>
+      key !== "outputFiles" && key !== "logs"
+    ))
+    : details;
+  const logs = Array.isArray(record?.logs)
+    ? record.logs.map(String)
+    : [];
+  return {
+    result: truncateResult(scriptResult),
+    ...(logs.length > 0
+      ? { logs: [truncateResponse(logs.join("\n"))] }
+      : {}),
+    ...(outputs.length > 0 ? { outputs } : {}),
+  };
+}
+
 function resourceBytes(resource: SkillResource): Uint8Array {
   if ((resource.encoding ?? "text") === "text") {
     return new TextEncoder().encode(resource.content);
@@ -249,7 +374,7 @@ function materializeSkillResourceTool(
     description:
       "Copy a complete bundled Skill resource directly into the Workspace without returning its contents to the model. " +
       "Use this instead of read_skill_resource when a template, script, image, font, or other asset must become a Workspace file. " +
-      "When multiple resources are needed, copy them in one execute with a loop or Promise.all; never start one execute per resource. " +
+      "When multiple resources are needed, copy them sequentially in one execute; never start one execute per resource. " +
       "The destination is created or overwritten, including parent directories.",
     inputSchema: z.object({
       name: z.enum(names).describe("Activated Skill name"),
@@ -332,7 +457,7 @@ export async function skillPiToolCandidates(
     }
     if (name === "read_skill_resource") {
       const execute = adapted.execute;
-      adapted.execute = (toolCallId, input, signal) => {
+      adapted.execute = async (toolCallId, input, signal) => {
         const target = input as { name?: unknown; path?: unknown };
         const parts = typeof target.path === "string"
           ? target.path.split("/")
@@ -343,32 +468,72 @@ export async function skillPiToolCandidates(
             parts.length === 2 &&
             parts[1] === "SKILL.md")
         ) {
-          return Promise.resolve({
+          return {
             content: [{ type: "text", text: SKILL_ENTRY_READ_GUIDANCE }],
             details: SKILL_ENTRY_READ_GUIDANCE,
-          });
+          };
         }
-        return execute(toolCallId, input, signal);
+        const resolved = resourceTarget(bindings, input);
+        if (resolved) {
+          const skill = await resolved.binding.source
+            .load(resolved.binding.name)
+            .catch(() => null);
+          const descriptor = skill?.resources?.find(({ path }) =>
+            path === resolved.path
+          );
+          if (
+            typeof descriptor?.size === "number" &&
+            descriptor.size > STORAGE_LEAF_MAX_CHARS
+          ) {
+            return materializationRequired(
+              resolved.binding.name,
+              resolved.path,
+              descriptor.size,
+            );
+          }
+        }
+        const output = await execute(toolCallId, input, signal);
+        if (
+          resolved &&
+          typeof output.details === "string" &&
+          output.details.length > STORAGE_LEAF_MAX_CHARS
+        ) {
+          return materializationRequired(
+            resolved.binding.name,
+            resolved.path,
+          );
+        }
+        return output;
       };
     }
     if (name === "run_skill_script") {
+      adapted.description +=
+        " Large artifacts must be written directly to Workspace, not returned or logged; scratch outputs are materialized to Workspace and returned only as file references.";
       adapted.prepareArguments = normalizeRunSkillScriptArguments;
+      const execute = adapted.execute;
+      adapted.execute = async (toolCallId, input, signal) => {
+        const output = await execute(toolCallId, input, signal);
+        return result(await projectSkillScriptResult(
+          output.details,
+          input,
+          toolCallId,
+          options.workspace,
+          signal,
+        ));
+      };
     }
     return {
       owner: "runtime-skill",
-      requiredExecutionLevel:
-        name === "run_skill_script" || name === "materialize_skill_resource"
-          ? "high"
-          : "safe",
+      requiredExecutionLevel: "safe",
       // activate_skill 返回的是 Skill 指令本身,是模型接下来所有动作的依据。把它外置
       // 成文件,模型手里就只剩一个路径,必须再取一次才能知道该做什么 —— 而典型
       // SKILL.md 正好落在会触发外置的区间。指令必须当场到手。
       ...(name === "activate_skill"
         ? { outputBudget: { kind: "structure" as const } }
         : {}),
-      ...(name === "materialize_skill_resource"
-        ? { codeExecutionOnly: true as const }
-        : {}),
+      ...(name === "activate_skill"
+        ? { exposureMode: "direct" as const }
+        : { exposureMode: "codemode" as const }),
       tool: adapted,
     };
   });

package/src/pi/tool/subagent.ts

@@ -180,6 +180,7 @@ export function subagentPiToolCandidates(
     };
     return {
       owner: `subagent:${type.name}`,
+      exposureMode: "direct",
       requiredExecutionLevel: "safe",
       tool,
     };
@@ -262,6 +263,7 @@ export function subagentPiToolCandidates(
   };
   candidates.push({
     owner: "subagent:background",
+    exposureMode: "direct",
     requiredExecutionLevel: "low",
     summary: "Dispatch a background sub-agent",
     source: "action",

package/src/pi/tool/time.ts

@@ -4,7 +4,7 @@ import type { PiToolCandidate } from "./compiler";
 
 export const GET_TIME_TOOL_NAME = "get_time";
 
-const parameters = Type.Object({});
+const parameters = Type.Object({}, { additionalProperties: false });
 
 /** Product-neutral current-time Tool for Host registries. */
 export function getTimePiToolCandidate(owner = "utilities"): PiToolCandidate {